CVE-2026-42013 is a certificate validation bypass vulnerability in GnuTLS caused by improper handling of oversized Subject Alternative Name (SAN) fields. When validating certificates, the presence of an oversized SAN can cause the validation logic to incorrectly revert to checking the Common Name (CN) field, bypassing intended SAN validation. This flaw can allow remote attackers to spoof certificates or conduct man-in-the-middle attacks by circumventing proper certificate validation. Red Hat's advisory confirms the issue and provides updated GnuTLS packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support that fix this vulnerability along with other related certificate validation issues. The vulnerability has a CVSS 3.1 base score indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality and integrity.

The vulnerability allows remote attackers to bypass proper certificate validation by exploiting the fallback to the Common Name field when an oversized SAN is present. This can lead to spoofing of TLS certificates or man-in-the-middle attacks, compromising confidentiality and integrity of communications secured by GnuTLS. The issue affects cryptographic trust decisions, potentially undermining secure connections.

Red Hat has released updated GnuTLS packages that address this vulnerability as part of a security advisory (RHSA-2026:43575). Users of Red Hat Enterprise Linux 7 Extended Lifecycle Support should apply the provided security updates to remediate this issue. Details and update instructions are available at https://access.redhat.com/articles/11258. No other mitigation actions are specified by the vendor advisory. Patch status is confirmed with official fixes available.