CVE-2026-42015: 
GnuTLS vulnerability analysis and mitigation

CVE-2026-42015 is a memory corruption vulnerability in GnuTLS caused by an off-by-one error in the PKCS#12 bag element bounds check. When appending an element to a PKCS#12 bag that already contains exactly 32 elements, the library writes past the end of its internal fixed-size array, resulting in heap memory corruption. The flaw was reported by Zou Dikai, first tracked in Red Hat Bugzilla on 2026-05-07, and publicly disclosed on 2026-05-26. It affects GnuTLS as shipped in Red Hat Enterprise Linux 8, 9, and 10, as well as downstream distributions including Ubuntu, Debian, SUSE, openSUSE, Oracle Linux, and Amazon Linux 2023. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is an off-by-one error (CWE-193) in the PKCS#12 bag element bounds check within libgnutls, which also manifests as an out-of-bounds write (CWE-787). The internal array for a PKCS#12 bag is sized for 32 elements (indices 0–31), but the bounds check incorrectly permits a write at index 32, one position past the end of the array. An unauthenticated remote attacker can trigger this condition by supplying a crafted PKCS#12 structure — for example, embedded in a TLS handshake or certificate import operation — that causes the library to attempt appending a 33rd bag element. No authentication or user interaction is required, and attack complexity is low (Github Advisory, Red Hat Bugzilla).

Successful exploitation causes heap memory corruption in the GnuTLS process, with the primary confirmed impact being a denial of service (DoS) through process crash. The CVSS score reflects low availability impact with no confidentiality or integrity impact; however, the advisory notes that "other unspecified impacts" cannot be ruled out, leaving open the theoretical possibility of more severe consequences depending on memory layout and application context. Any service that relies on GnuTLS for TLS/SSL processing and accepts PKCS#12 input from untrusted sources — such as VPN endpoints, web servers, or certificate management tools — is within the affected asset scope (Github Advisory, Red Hat Bugzilla).

Red Hat has released patched gnutls packages addressing this vulnerability across all affected RHEL versions: gnutls-3.6.16-8.el8_10.6 for RHEL 8 (via RHSA-2026:20611), gnutls-3.8.10-4.el9_8 for RHEL 9 (via RHSA-2026:20612), and a corresponding update for RHEL 10 (via RHSA-2026:20613). Patches have also been issued by Ubuntu (USN-8284-1), Debian (LTS announcement), SUSE (SUSE-SU-2026:2087-1, SUSE-SU-2026:2115-1), openSUSE, Amazon Linux 2023 (ALAS2023-2026-1757), and AlmaLinux/Oracle Linux. The recommended remediation is to apply the vendor-supplied update immediately. As a temporary workaround, restrict network access to services that process PKCS#12 data from untrusted sources and monitor for unexpected crashes in GnuTLS-dependent services (Red Hat RHSA-8, Red Hat RHSA-9, Github Advisory).

Red Hat triaged the issue as Medium severity and coordinated patches across RHEL 8, 9, and 10 simultaneously on 2026-05-26, reflecting standard handling for a DoS-class memory corruption bug in a widely deployed cryptographic library. Multiple downstream Linux distributions — including Ubuntu, Debian, SUSE, openSUSE, Amazon Linux, AlmaLinux, and Oracle Linux — issued security advisories within days of the upstream disclosure, indicating broad ecosystem awareness. No notable independent researcher commentary or significant social media discussion has been identified beyond routine CVE tracking and distribution advisory coverage.