CVE-2026-33845
HighCVSS 7.5Exploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.
Risk Assessment
The organization risks sensitive data leakage or service disruption for applications using DTLS in GnuTLS, potentially compromising communication security and system availability.
Recommendation
Immediately update the GnuTLS library to a patched version and verify that all systems using DTLS are protected.
Other vulnerabilities in GnuTLS
See all- CVE-2016-4456High
The 'GNUTLS_KEYLOGFILE' environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem.
- CVE-2017-7507High
GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application.
- CVE-2017-7869High
GnuTLS before February 20, 2017, has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue is a subset of the vendor's GNUTLS-SA-2017-3 report and is fixed in version 3.5.10.
- CVE-2017-5335High
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.
- CVE-2016-7444High
The gnutls_ocsp_resp_check_crt function in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism.
- CVE-2015-3308High
A double free vulnerability in lib/x509/x509_ext.c in GnuTLS before version 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.
- CVE-2021-20232Critical
A flaw was found in gnutls. A use-after-free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.
- CVE-2021-20231Critical
A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.
- CVE-2020-13777High
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.
- CVE-2017-5337Critical
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.
Original NVD description (English source)
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS