This vulnerability in gnutls affects Red Hat Enterprise Linux 10 and arises from improper handling of certificates with URI or SRV Subject Alternative Names. When such certificates are presented, the validation process may incorrectly revert to validating DNS hostnames against the Common Name field, which can be exploited by remote attackers to impersonate legitimate services or intercept data. The CVSS 3.1 score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. The vendor advisory link is provided but does not explicitly confirm patch or mitigation status.

A remote attacker can exploit this vulnerability by presenting a specially crafted certificate to cause improper validation. This may enable spoofing of legitimate services or interception of sensitive information, impacting confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-42012 for current remediation guidance. Until an official fix is available, consider limiting exposure to untrusted certificates or employing additional certificate validation controls if feasible.