CVE-2026-42014

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42014
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-42014.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-42014
Downstream
ALPINE (1)
AZL (1)
BELL (1)
DEBIAN (1)
ECHO (1)
OESA (5)
openSUSE (2)
RHSA (12)
RLSA (3)
SUSE (10)
UBUNTU (1)
Related
openSUSE (2)
SUSE (10)
Published
2026-06-16T00:49:15Z
Modified
2026-10-02T11:46:01Z
Severity
  • 6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
Summary
Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin
Details

A flaw was found in GnuTLS. The gnutls_pkcs11_token_set_pin function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-825"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42014.json"
}
References

Affected packages

Git / gitlab.com/gnutls/gnutls

Affected ranges

Type
GIT
Repo
https://gitlab.com/gnutls/gnutls
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other
0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-42014.json"