Submit finding

All findings

CVE-2026-42010 high

GnuTLS credits AISLE on an RSA-PSK authentication bypass

CVE-2026-42010 lets a NUL-containing RSA-PSK username match an unintended identity; GnuTLS rates the issue high and fixes it in 3.8.13.

Bug class
Authentication bypass through embedded-NUL username handling
Affected codebase
GnuTLS RSA-PSK authentication
Credited system
AISLE
Disclosed
April 29, 2026
Attribution
Self-reported attribution
AI role
Discovery
Severity
high
Source status: GnuTLS' upstream advisory credits Joshua Rogers of AISLE, rates the issue high, and identifies 3.8.13 as fixed. AISLE supplies the autonomous-system attribution.

Summary

GnuTLS’ RSA-PSK username handling can compare a NUL-containing identity as if it were a shorter authorized name. The result is an authentication bypass in affected configurations. GnuTLS 3.8.13 fixes the flaw.

Bugflation follows the vendor’s high rating. Red Hat’s CNA score is 7.1, which does not support AISLE’s registry score of 9.8; the upstream severity therefore takes precedence.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.