Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-33846

Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  3. Record last updated

Affected versions

  • gnutls

    Version range not reported

  • gnutls

    Version range not reported

  • gnutls

    Version range not reported

  • gnutls

    Version range not reported

  • gnutls

    Version range not reported

  • libtasn1

    Version range not reported

  • gnutls

    Version range not reported

  • libtasn1

    Version range not reported

  • gnutls

    Version range not reported

  • libtasn1

    Version range not reported

  • gnutls

    Version range not reported

  • libtasn1

    Version range not reported

  • gnutls

    Version range not reported

  • libtasn1

    Version range not reported

  • gnutls

    Version range not reported

  • libtasn1

    Version range not reported

  • gnutls

    Version range not reported

  • gnutls

    Version range not reported

  • gnutls

    Version range not reported

  • gnutls

    Version range not reported

  • openshift/ose-rhel-coreos-8

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

  • cert-manager/jetstack-cert-manager-acmesolver-rhel9

    Version range not reported

  • cert-manager/jetstack-cert-manager-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-bundle

    Version range not reported

  • cert-manager/jetstack-cert-manager-acmesolver-rhel9

    Version range not reported

  • cert-manager/jetstack-cert-manager-rhel9

    Version range not reported

  • cert-manager/cert-manager-istio-csr-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-bundle

    Version range not reported

  • cert-manager/cert-manager-trust-manager-rhel9

    Version range not reported

  • rhaiis/model-opt-cuda-rhel9

    Version range not reported

  • rhaiis/vllm-cuda-rhel9

    Version range not reported

  • rhaiis/vllm-rocm-rhel9

    Version range not reported

  • discovery/discovery-server-rhel9

    Version range not reported

  • discovery/discovery-ui-rhel9

    Version range not reported

  • gnutls-main

    Version range not reported

  • rhai/base-image-neuron-rhel9

    Version range not reported

  • rhui5/cds-rhel9

    Version range not reported

  • rhui5/haproxy-rhel9

    Version range not reported

  • rhui5/installer-rhel9

    Version range not reported

  • rhui5/rhua-rhel9

    Version range not reported

  • rhui5/cds-kubernetes-tp-rhel9

    Version range not reported

  • rhui5/installer-tp-rhel9

    Version range not reported

  • rhui5/rhua-tp-rhel9

    Version range not reported

  • gnutls

    Version range not reported

  • openshift4/ose-hypershift-rhel9

    Version range not reported

References 25

access.redhat.com