Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-42009: The comparator function used for ordering DTLS packets by sequence numbers did not follow qsort comparator contracts in case of packets with duplicate sequence numbers, which could lead to undefined behaviour. CVE-2026-33846: GnuTLS didn't check that DTLS fragments claimed a consistent message_length value. Additionally, a crucial array size check was missing, enabling an attacker to cause a heap overwrite. CVE-2026-33845: A remotely triggerable underflow in the DTLS reassembly code led to a heap overrun. The issue was reported in the issue tracker as #1811 by Joshua Rogers of AISLE Research Team.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | gnutls | 0:3.3.29-9.amzn2.0.4 |
| Amazon Linux · 2 | gnutls-c++ | 0:3.3.29-9.amzn2.0.4 |
| Amazon Linux · 2 | gnutls-dane | 0:3.3.29-9.amzn2.0.4 |
| Amazon Linux · 2 | gnutls-debuginfo | 0:3.3.29-9.amzn2.0.4 |
| Amazon Linux · 2 | gnutls-devel | 0:3.3.29-9.amzn2.0.4 |
| Amazon Linux · 2 | gnutls-utils | 0:3.3.29-9.amzn2.0.4 |
Vulnerabilities 3
-
High 7.5
Gnutls: gnutls: denial of service via dtls zero-length fragment
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information dis…
-
High 7.5
Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating th…
-
High 7.5
Gnutls: gnutls: denial of service via dtls packet reordering vulnerability
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets …