Paper/Archive/CVE-2026-33845

CVE-2026-33845

Red Hat Red Hat Enterprise Linux 10 — Gnutls: gnutls: denial of service via dtls zero-length fragment

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 81.4.814 × 2016.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

Affected

ProductAffectedFixed inSource

gnutls< 3.8.133.8.13CNA

Red Hat Enterprise Linux 10see advisory0:3.8.10-4.el10_2CNA

Red Hat Enterprise Linux 10.0 Extended Update Supportsee advisory0:3.8.9-9.el10_0.19CNA

Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory0:3.3.29-9.el7_9.1CNA

Red Hat Enterprise Linux 8see advisory0:3.6.16-8.el8_10.6CNA

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory0:3.6.14-10.el8_4.1CNA

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory0:4.13-3.el8_4.1CNA

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory0:3.6.14-10.el8_4.1CNA

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory0:4.13-3.el8_4.1CNA

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory0:3.6.16-5.el8_6.5CNA

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory0:4.13-3.el8_6.2CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

redhat (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

redhat-SADP (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References