Vulnerability in Red Hat Discovery 2
CVE-2026-42012
A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.
Vulnerability class: Improper Certificate Validation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N.
EPSS exploit prediction
EPSS: 0.005 (39.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 39.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.001
Affected products
- Red Hat Discovery 2 — versions 1782159791, 1782166952
- Red Hat Enterprise Linux 10 — versions 0:3.8.10-4.el10_2
- Red Hat Enterprise Linux 10.0 Extended Update Support — versions 0:3.8.9-9.el10_0.19
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 7 Extended Lifecycle Support — versions 0:3.3.29-9.el7_9.2
- Red Hat Enterprise Linux 8 — versions 0:3.6.16-8.el8_10.6
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support — versions 0:3.6.14-10.el8_4.1, 0:4.13-3.el8_4.1
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On — versions 0:3.6.14-10.el8_4.1, 0:4.13-3.el8_4.1
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support — versions 0:3.6.16-5.el8_6.5, 0:4.13-3.el8_6.2
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-42012 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
- access.redhat.com/errata/RHSA-2026:20611 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:20613 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:20612 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:26319 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:26409 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:29197 (vendor-advisory)
- www.gnutls.org/security-new.html
- access.redhat.com/errata/RHSA-2026:30004 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-42012?
- CVE-2026-42012 is a high-severity vulnerability in Red Hat Discovery 2, classified under Improper Certificate Validation. CVSS score: 7.1/10. Published 2026-05-26.
- How severe is CVE-2026-42012?
- High severity. CVSS v3 base score is 7.1 out of 10.