CVE-2026-42015 — Red Hat Vulnerability Details

What is CVE-2026-42015?

A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts.

The record classifies CVE-2026-42015 under weakness class CWE-193. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction. 12 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 152 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 5.3 — MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS (FIRST): 0.9% probability of exploitation in the next 30 days, higher than 59.0% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 5/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2026-05-26, last modified 2026-10-02

Is CVE-2026-42015 being exploited?

It currently carries a trending score of 20 in the Threadlinqs vulnerability feed.

Affected products and versions

Red Hat: Enterprise Linux 10, Enterprise Linux 10.0 Extended Update Support, Enterprise Linux 7 Extended Lifecycle Support, Enterprise Linux 8, Enterprise Linux 8.4 Advanced Mission Critical Update Support, Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Enterprise Linux 8.6 Advanced Mission Critical Update Support, Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Enterprise Linux 8.8 Telecommunications Update Service, Enterprise Linux 8.8 Update Services for SAP Solutions, Enterprise Linux 9, Enterprise Linux 9.2 Update Services for SAP Solutions

How to fix CVE-2026-42015

No vendor patch reference has been recorded for CVE-2026-42015 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2026-42015

1 tracked threat in the Threadlinqs corpus references CVE-2026-42015, either in the campaign’s CVE list or as an indicator on the campaign record.

Vulnerability in F5 Products (CVE-2026-42015) — BIG-IP Next CNF, BIG-IP Next for Kubernetes, F5OS — MEDIUM · 2026-09-24

Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories. Last verified by Threadlinqs on 2026-10-10.

CVE-2026-42015 — Red Hat Enterprise Linux 8.8 Telecommunications Update Service