GnuTLS CVE-2026-42011: Brief Summary of the Name Constraints Bypass in Certificate Validation

Introduction

A logic error in GnuTLS's X.509 certificate chain validation silently discards permitted name constraints from subordinate Certificate Authorities, so certificates that should be narrowly scoped end up trusted more broadly. For any system that relies on GnuTLS for TLS certificate verification, a carefully constructed certificate chain could pass validation even when the leaf certificate's Subject Alternative Name falls outside the namespace the issuing CA was authorized to certify.

GnuTLS is a widely used secure communications library that implements the SSL, TLS, and DTLS protocols. It provides a C-language API for accessing secure communications protocols and for parsing and writing X.509, PKCS #12, and related structures. It is a core TLS backend in many Linux distributions and is built into a broad range of applications and services.

Technical Information

Root Cause

CVE-2026-42011, classified under CWE-295 (Improper Certificate Validation), comes from a logic error in the name_constraints_node_list_intersect() function in lib/x509/name_constraints.c. This function computes the intersection of the permitted subtrees accumulated so far with the new ones that a subordinate CA in the certificate chain introduces.

The vulnerable code had an early-return guard at approximately line 803:

// VULNERABLE CODE (removed by the patch)
if (gl_list_size(permitted1->items) == 0 ||
    gl_list_size(permitted2->items) == 0)
    return GNUTLS_E_SUCCESS;

This check treated an empty permitted list as "nothing to do" and returned success immediately. In RFC 5280's Name Constraints model, though, an empty permitted set represents the universal set, in which all names are permitted. When a subordinate CA then narrows this with, say, permittedSubtrees = [good.com], the correct intersection, Universal ∩ {good.com}, is {good.com}. The early return instead discarded the subordinate's constraints and left the universal set intact.

Attack Flow

Exploitation requires this certificate chain configuration:

1. A Root CA with a nameConstraints extension containing only excludedSubtrees (for example, excluding evil.com). This Root CA has no permittedSubtrees, so the accumulated permitted set starts empty, which means universal.

2. An Intermediate CA issued by the Root, with a nameConstraints extension containing permittedSubtrees (for example, permitting only good.com).

3. A Leaf certificate issued by the Intermediate CA with an arbitrary Subject Alternative Name, such as attacker.com.

When GnuTLS processes the chain and reaches the Intermediate CA's permitted constraints, it calls name_constraints_node_list_intersect() to intersect the accumulated permitted set (empty, meaning universal) with the Intermediate's permitted set (good.com). The buggy early return fires because permitted1->items has size 0, and the function returns without changing anything. The Intermediate's restriction to good.com is silently dropped.

As a result, the leaf certificate for attacker.com passes validation, even though the Intermediate CA was only supposed to issue certificates for good.com. A remote attacker in a man-in-the-middle position could present such a chain to impersonate arbitrary domains, limited only by the Root CA's excluded list.

The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, which scores 7.4 High. Attack complexity is High because the attacker needs an active network interception position. Confidentiality and Integrity impacts are both rated High, and Availability is unaffected.

Patch Information

The GnuTLS project patched CVE-2026-42011 in version 3.8.13, released on April 29, 2026, through merge request !2102. The closing commit is 1dead2fa, authored by Alexander Sosedkin, with the message "x509/name_constraints: fix intersecting empty constraints".

The fix is an elegant four-line deletion. Here is the diff from the commit:

--- a/lib/x509/name_constraints.c
+++ b/lib/x509/name_constraints.c
@@ -800,10 +800,6 @@ static int name_constraints_node_list_intersect(
	san_flags_t types_in_p1 = 0, types_in_p2 = 0;
	static const unsigned char universal_ip[32] = { 0 };

-	if (gl_list_size(permitted1->items) == 0 ||
-	    gl_list_size(permitted2->items) == 0)
-		return GNUTLS_E_SUCCESS;
-
	/* First partition PERMITTED1 into supported and unsupported lists */
	ret = name_constraints_node_list_init(&supported1);
	if (ret < 0) {

With the early return gone, the function always falls through to the full intersection logic, which already handles an empty permitted list correctly. When permitted1 is empty (universal) and permitted2 contains entries, the intersection produces the entries from permitted2, exactly as RFC 5280 Section 6.1.4 step (b) requires.

The fix has some history behind it. A parallel refactoring effort in !2083, which rewrote the name constraints system to use rbtree-backed sorted lists, had already changed the data structures from the original size-based arrays to gl_list-based containers. In the issue discussion, maintainer Alexander Sosedkin noted that an intermediate version of !2083 had already dropped this early return, which let the final fix for CVE-2026-42011 be a simple deletion. Two separate backport patches were prepared: 1824-3.8.12-v1.patch for systems still on the pre-rework 3.8.12 codebase, and 1824-3.8.13pre-v1.patch for the post-rework code that shipped in 3.8.13.

The commit also expands test coverage in tests/name-constraints-merge with cases that intersect an empty permitted set with a non-empty one, so the regression cannot silently reappear.

Patch Status Across Ecosystems

Organizations should prioritize patching internet-facing services that use GnuTLS for certificate validation. On Debian 13, administrators should monitor vendor advisories until a fixed version of the gnutls28 package is available.

Affected Systems and Versions

Anyone using certificate authentication with any version of GnuTLS before 3.8.13 is potentially affected. The vulnerable code is the name_constraints_node_list_intersect() function in lib/x509/name_constraints.c.

The fixed version is GnuTLS 3.8.13, released April 29, 2026. Every earlier version that implements X.509 name constraints processing is vulnerable when it encounters the specific certificate chain configuration (Root CA with only excluded constraints, Intermediate CA with permitted constraints).

Vendor Security History

The GnuTLS project has a documented history of fixing security vulnerabilities in its TLS and X.509 implementation. Notable past issues include CVE-2014-3466, a memory corruption vulnerability, and CVE-2014-3566, related to the POODLE attack against SSLv3. The project maintains a public security advisory page and tracks issues on its GitLab instance. Haruto Kimura reported CVE-2026-42011 in the issue tracker, and it was assigned the advisory identifier GNUTLS-SA-2026-04-29-6.

References

• NVD: CVE-2026-42011
• Red Hat CVE Page: CVE-2026-42011
• Red Hat Bugzilla: Bug 2467437
• GnuTLS GitLab Issue #1824: Name Constraints Bypass via Empty Permitted Subtrees Intersection
• GnuTLS GitLab Commit 1dead2fa: Fix intersecting empty constraints
• GnuTLS GitLab Commit 1dead2fa (diff)
• GnuTLS GitLab Merge Request !2102
• GnuTLS GitLab Merge Request !2083: rbtree list refactor
• GnuTLS Security Advisories
• RHSA-2026:13274 Security Advisory
• Fedora 43 GnuTLS 3.8.13 Security Update
• Snyk: CVE-2026-42011 in gnutls28 (Debian 13)
• GnuTLS Project Homepage
• GnuTLS Historical Security Advisories