Description
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.20 | — | — |
| Red Hat | Red Hat AI Inference Server 3.2 | — | — |
| Red Hat | Red Hat Discovery 2 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat Update Infrastructure 5 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gnutls28 | 3.8.13-1 | — |
| Debian 13 | gnutls28 | 3.8.9-3+deb13u4 | — |
| Debian 12 | gnutls28 | 3.7.9-2+deb12u7 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | gnutls28 | 3.8.12-2ubuntu1.1 | — |
| Ubuntu 25.10 | gnutls28 | 3.8.9-3ubuntu2.2 | — |
| Ubuntu 24.04 LTS | gnutls28 | 3.8.3-1.1ubuntu3.6 | — |
| Ubuntu 22.04 LTS | gnutls28 | 3.7.3-4ubuntu1.9 | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro FIPS-updates 24.04 LTS | gnutls28 | 3.8.3-1.1ubuntu3.6+Fips1.2 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | gnutls28 | 3.7.3-4ubuntu1.9+Fips1 | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | gnutls28 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | gnutls28 | 3.6.13-2ubuntu1.12+esm2 | USN-8502-1 |
| Ubuntu Pro 18.04 LTS | gnutls28 | 3.5.18-1ubuntu1.6+esm3 | USN-8502-1 |
| Ubuntu Pro 16.04 LTS | gnutls28 | 3.4.10-4ubuntu1.9+esm3 | USN-8502-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gnutls +5 | 3.8.10-4.el10_2 | RHSA-2026:20613 |
| RHEL 9 | gnutls +4 | 3.8.10-4.el9_8 | RHSA-2026:20612 |
| RHEL 8 | gnutls +4 | 3.6.16-8.el8_10.6 | RHSA-2026:20611 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | gnutls +5 | 3.8.9-9.el10_0.19 | RHSA-2026:26409 |
| RHEL 9.6 EUS | gnutls +4 | 3.8.3-6.el9_6.4 | RHSA-2026:30004 |
| RHEL 9.4 E4S | gnutls +4 | 3.8.3-4.el9_4.6 | RHSA-2026:32962 |
| RHEL 9.2 E4S | gnutls +4 | 3.7.6-21.el9_2.7 | RHSA-2026:41921 |
| RHEL 8.8 TUS | gnutls +4 | 3.6.16-7.el8_8.4 | RHSA-2026:30850 |
| RHEL 8.8 TUS | libtasn1 +2 | 4.13-4.el8_8.1 | RHSA-2026:30850 |
| RHEL 8.8 E4S | gnutls +4 | 3.6.16-7.el8_8.4 | RHSA-2026:30850 |
| RHEL 8.8 E4S | libtasn1 +2 | 4.13-4.el8_8.1 | RHSA-2026:30850 |
| RHEL 8.6 EUS Long Life | gnutls +4 | 3.6.16-5.el8_6.5 | RHSA-2026:30849 |
| RHEL 8.6 EUS Long Life | libtasn1 +2 | 4.13-3.el8_6.2 | RHSA-2026:30849 |
| RHEL 8.6 AUS | gnutls +4 | 3.6.16-5.el8_6.5 | RHSA-2026:30849 |
| RHEL 8.6 AUS | libtasn1 +2 | 4.13-3.el8_6.2 | RHSA-2026:30849 |
| RHEL 8.4 EUS Long Life | gnutls +4 | 3.6.14-10.el8_4.1 | RHSA-2026:33125 |
| RHEL 8.4 EUS Long Life | libtasn1 +2 | 4.13-3.el8_4.1 | RHSA-2026:33125 |
| RHEL 8.4 AUS | gnutls +4 | 3.6.14-10.el8_4.1 | RHSA-2026:33125 |
| RHEL 8.4 AUS | libtasn1 +2 | 4.13-3.el8_4.1 | RHSA-2026:33125 |
| RHEL 7 ELS | gnutls +4 | 3.3.29-9.el7_9.1 | RHSA-2026:34372 |
| Red Hat Hardened Images 1 | gnutls +7 | 3.8.13-1.hum1 | RHSA-2026:13274 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gnutls +5 | 3.8.10-4.el10_2 | ALSA-2026:20613 |
| AlmaLinux 9 | gnutls +4 | 3.8.10-4.el9_8 | ALSA-2026:20612 |
| AlmaLinux 8 | gnutls +4 | 3.6.16-8.el8_10.6 | ALSA-2026:20611 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gnutls | 3.8.10-4.el10_2 | RLSA-2026:20613 |
| Rocky Linux 9 | gnutls | 3.8.10-4.el9_8 | RLSA-2026:20612 |
| Rocky Linux 8 | gnutls | 3.6.16-8.el8_10.6 | RLSA-2026:20611 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | gnutls | 3.3.27-3.18.1 | SUSE-SU-2026:2367-1, SUSE-SU-2026:2366-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.3 | gnutls | 3.7.3-150400.24.2 | SUSE-SU-2026:2822-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gnutls | 3.8.13-1.1 | openSUSE-SU-2026:10691-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | gnutls | 3.8.13-r0 | — |
| Alpine v3.23 | gnutls | 3.8.13-r0 | — |
| Alpine v3.22 | gnutls | 3.8.13-r0 | — |
| Alpine v3.21 | gnutls | 3.8.13-r0 | — |
| Alpine v3.20 | gnutls | 3.8.13-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | gnutls +4 | 3.8.3-8.amzn2023.0.3 | ALAS2023-2026-1757 |
| Amazon Linux 2 | gnutls +4 | 3.3.29-9.amzn2.0.4 | ALAS2-2026-3324 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | gnutls | 3.8.3-11 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | gnutls +5 | 3.8.10-4.el10_2 | ELSA-2026-20613 |
| Oracle Linux 9 | gnutls +4 | 3.8.10-4.el9_8 | ELSA-2026-50346, ELSA-2026-20612 |
| Oracle Linux 8 | gnutls +4 | 3.6.16-8.el8_10.6 | ELSA-2026-20611 |
| Oracle Linux 7 | gnutls +4 | 3.3.29-9.0.1.el7_9 | ELSA-2026-34372 |
Advisories 35
- WID-SEC-2026-1312 GnuTLS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:20613 Important: gnutls security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:20612 Important: gnutls security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:20611 Important: gnutls security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-3623 IBM DataPower Gateway: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2026:41921 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:33125 Red Hat Security Advisory: gnutls and libtasn1 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:32962 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:30850 Red Hat Security Advisory: gnutls and libtasn1 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:30849 Red Hat Security Advisory: gnutls and libtasn1 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:30004 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:26409 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:20613 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:20611 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:20612 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:13274 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- NCSC-2026-0431 Kwetsbaarheden verholpen in IBM DataPower Gateway en onderliggende componenten NCSC-NL (Netherlands) · Oct 16, 2026
- RHSA-2026:34372 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2026-3043 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- VDE-2026-088 METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4 CERT@VDE · Sep 10, 2026
- ELSA-2026-34372 Important: gnutls security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 6, 2026
- ELSA-2026-20613 Important: gnutls security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 17, 2026
- SUSE-SU-2026:2822-1 Security update for gnutls SUSE / openSUSE Security Updates · Jul 10, 2026
- USN-8502-1 gnutls28 vulnerabilities Ubuntu Security Notices (USN) · Jul 6, 2026
- ELSA-2026-50346 Important: gnutls security fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 24, 2026
- ELSA-2026-20612 Important: gnutls security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 24, 2026
- SUSE-SU-2026:2366-1 Security update for gnutls SUSE / openSUSE Security Updates · Jun 12, 2026
- SUSE-SU-2026:2367-1 Security update for gnutls SUSE / openSUSE Security Updates · Jun 12, 2026
- ALAS2-2026-3324 Important: gnutls security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 8, 2026
- RLSA-2026:20613 Important: gnutls security update Rocky Linux Security Advisories · Jun 5, 2026
- RLSA-2026:20612 Important: gnutls security update Rocky Linux Security Advisories · Jun 2, 2026
- RLSA-2026:20611 Important: gnutls security update Rocky Linux Security Advisories · May 29, 2026
- ELSA-2026-20611 Important: gnutls security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 27, 2026
- ALAS2023-2026-1757 Important: gnutls security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 26, 2026
- openSUSE-SU-2026:10691-1 gnutls-3.8.13-1.1 on GA media SUSE / openSUSE Security Updates · May 6, 2026
References
- RHSA-2026:13274 vendor-advisory
- RHSA-2026:20611 vendor-advisory
- RHSA-2026:20612 vendor-advisory
- RHSA-2026:20613 vendor-advisory
- RHSA-2026:26319 vendor-advisory
- RHSA-2026:26409 vendor-advisory
- RHSA-2026:29197 vendor-advisory
- RHSA-2026:30004 vendor-advisory
- RHSA-2026:30849 vendor-advisory
- RHSA-2026:30850 vendor-advisory
- RHSA-2026:32962 vendor-advisory
- RHSA-2026:33125 vendor-advisory
- RHSA-2026:34372 vendor-advisory
- RHSA-2026:36004 vendor-advisory
- RHSA-2026:36005 vendor-advisory
- RHSA-2026:36006 vendor-advisory
- RHSA-2026:41921 vendor-advisory
- RHSA-2026:56786 vendor-advisory
- RHSA-2026:56853 vendor-advisory
- RHSA-2026:56911 vendor-advisory
- RHSA-2026:57402 vendor-advisory
- RHSA-2026:57483 vendor-advisory
- RHSA-2026:58981 vendor-advisory
- RHSA-2026:59831 vendor-advisory
- RHSA-2026:60019 vendor-advisory
- RHSA-2026:65839 vendor-advisory
- RHSA-2026:72502 vendor-advisory
- RHSA-2026:74674 vendor-advisory
- RHSA-2026:82304 vendor-advisory
- RHSA-2026:82322 vendor-advisory
- RHSA-2026:82347 vendor-advisory
- RHSA-2026:82354 vendor-advisory
- RHSA-2026:82372 vendor-advisory
- RHSA-2026:82857 vendor-advisory
- RHSA-2026:82888 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-33846 vdb-entry
- RHBZ#2450625 issue-tracking