Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach DTLS-enabled GnuTLS endpoint
  2. Delivery
    Send crafted handshake fragment (zero len, non-zero offset)
  3. Exploit
    Trigger integer underflow in reassembly
  4. Execution
    Out-of-bounds read
  5. Impact
    Leak memory or crash service

Vulnerability Assessment

Weakness
CWE
CWE-191
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
Exploitation Conditions

Exploitation requires that the target run a DTLS-capable service backed by a vulnerable GnuTLS build and that the attacker can send DTLS handshake traffic to it; the specific trigger is a malformed handshake fragment declaring zero length together with a non-zero offset, which is parsed during fragment reassembly. Per CVSS AV:N/AC:L/PR:N/UI:N this is remote and unauthenticated against a reachable DTLS endpoint with no special privileges or user interaction needed. The principal limiting factor is that DTLS must actually be in use and network-reachable - purely TLS-over-TCP deployments that never invoke the DTLS reassembly path are not exposed - and the realistic impact skews toward crash/DoS and memory disclosure rather than code execution.
Impact

Signals conflict in instructive ways. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/A:H) yields 9.1 and implies trivially reachable, unauthenticated, network-facing exploitation with serious confidentiality and availability impact. However, EPSS is only 0.04% (11th percentile) and CISA SSVC marks Exploitation as 'none', Technical Impact 'partial', though Automatable 'yes' - together suggesting that while the bug class is automatable, there is no observed or predicted near-term mass exploitation. The realistic primary impact is denial of service (crash via OOB read) and potential information disclosure of adjacent memory; this is not a remote-code-execution primitive, which tempers the 'critical' label despite the 9.1 score. The high CVSS C:H rating presumes meaningful memory leakage, but an OOB read's actual disclosure value depends on memory layout and is uncertain. Bottom line: a genuine, patch-now issue for internet-facing DTLS services, but the low EPSS and 'none' SSVC exploitation status indicate it is not currently under active or imminent widespread attack - prioritize by exposure of DTLS endpoints rather than treating it as an emergency zero-day.
Exploit ScenarioDerived

An attacker who can reach a DTLS-enabled service (for example a VPN, VoIP/SIP, or WebRTC endpoint backed by GnuTLS) sends crafted DTLS handshake fragments with zero length and a non-zero offset, triggering the integer underflow during reassembly and forcing an out-of-bounds read. This crashes the service (denial of service) or returns leaked adjacent memory contents to the attacker, all without authentication or user interaction. No public proof-of-concept has been identified at time of analysis.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 24, 2026

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an integer underflow by sending malformed handshake fragments with zero length and a non-zero offset, enabling information disclosure or denial of service against Red Hat-shipped GnuTLS (RHEL 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images). Reported by Red Hat with a vendor patch available and errata released; no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile) with SSVC exploitation status 'none'. CVSS 9.1 reflects high confidentiality and availability impact over the network at low complexity without authentication.

Earlier versions of this analysis (2)
v2 Jun 24, 2026 - 17:29 cvss changed CVSS 9.1

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote attackers crash services or leak memory by sending malformed handshake fragments. The flaw stems from an integer underflow when a fragment declares zero length but a non-zero offset, miscomputing the reassembly buffer math. It is remotely triggerable without authentication; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%).

v1 Apr 30, 2026 - 18:15 CVSS 7.5

Integer underflow in GnuTLS DTLS handshake reassembly allows remote unauthenticated attackers to trigger denial of service or information disclosure via crafted zero-length fragments with non-zero offsets. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and EPSS data unavailable, this represents a clear remote attack surface requiring no authentication, though the CVSS vector indicates availability impact only (A:H) with no confidentiality or integrity impact confirmed, contradicting the description's mention of information disclosure. No CISA KEV listing or public exploit identified at time of analysis.

RemediationAI

Apply the vendor-released GnuTLS update for your platform: on Red Hat systems install the package versions from the applicable errata (RHSA-2026:13274, RHSA-2026:20611/20612/20613, RHSA-2026:26319, RHSA-2026:26409, RHSA-2026:29197) per https://access.redhat.com/security/cve/CVE-2026-33845, and on Ubuntu apply USN-8284-1 (https://ubuntu.com/security/notices/USN-8284-1), then restart or re-link affected services so the patched library is loaded. Exact fixed versions are listed in those advisories; consult the Red Hat Bugzilla tracker (https://bugzilla.redhat.com/show_bug.cgi?id=2450624) for package detail. If immediate patching is not possible, reduce exposure by disabling DTLS on services that do not require it or restricting reachability of DTLS endpoints (e.g., firewall the relevant UDP ports to trusted peers only) - the trade-off is loss of DTLS-based functionality (such as DTLS-protected VPN/VoIP/WebRTC transports) for clients that depend on it; prefer TLS-over-TCP paths where the application supports both. These are compensating controls only and do not remove the underlying flaw, so schedule the library update.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GnuTLS is a widely-used open-source library implementing TLS, DTLS, and related cryptographic protocols, linked by many Linux applications and services for secure transport. The flaw lives in DTLS handshake fragment reassembly: DTLS splits handshake messages into fragments carrying a length and offset, and the parser fails to validate a fragment that declares zero length together with a non-zero offset. CWE-191 (Integer Underflow / wraparound) is the root cause: a subtraction during reassembly underflows, producing a huge unsigned value that drives an out-of-bounds read past the intended buffer. The affected products per CPE are Red Hat's GnuTLS packages across Red Hat Enterprise Linux 6, 7, 8, 9, and 10, Red Hat OpenShift Container Platform 4, and Red Hat Hardened Images, indicating the vulnerable code is in the GnuTLS shipped/maintained in those distributions rather than a single application.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 8.2 HIGH

Remote unauthenticated DTLS parsing flaw (AV:N/AC:L/PR:N/UI:N); reliable crash gives A:H, but OOB-read disclosure is bounded/uncertain so C:L rather than C:H, no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jun 24, 2026 - 17:30 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 24, 2026 - 17:29 vuln.today
v2 - CVSS changed
Severity Changed
Jun 24, 2026 - 17:22 NVD
HIGH CRITICAL
CVSS changed
Jun 24, 2026 - 17:22 NVD
7.5 (HIGH) 9.1 (CRITICAL)
CVE Published
Apr 30, 2026 - 17:41 nvd
HIGH 7.5

DescriptionNVD

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

Executive ViewAI

Why It Matters

GnuTLS implementations in Red Hat Enterprise Linux (RHEL 6-10), OpenShift Container Platform 4, and Red Hat Hardened Images are vulnerable to remote unauthenticated attacks enabling data disclosure or denial of service; no public exploit identified at time of analysis. Organizations should prioritize patching these critical systems to prevent confidentiality breaches and service disruption.

Business Impact: Severe
Compensating Controls

Apply vendor patch. Red Hat security errata are available for all affected RHEL versions and OpenShift Container Platform 4.

Threat Intelligence Overview

EPSS Score
0.0%
Top 89% exploitable
Prevalence
Ubiquitous
core TLS/DTLS library shipped across all major Linux distributions
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Partial

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)NVD

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_hardened_images:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8284-1 ADVISORY https://vuldb.com/vuln/360337 REF https://access.redhat.com/errata/RHSA-2026:13274 REF https://access.redhat.com/errata/RHSA-2026:20611 REF https://access.redhat.com/errata/RHSA-2026:20612 REF https://access.redhat.com/errata/RHSA-2026:20613 REF https://access.redhat.com/errata/RHSA-2026:26319 REF https://access.redhat.com/errata/RHSA-2026:26409 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:30004 REF https://access.redhat.com/errata/RHSA-2026:30849 REF https://access.redhat.com/errata/RHSA-2026:30850 REF https://access.redhat.com/errata/RHSA-2026:32962 REF https://access.redhat.com/errata/RHSA-2026:33125 REF https://access.redhat.com/errata/RHSA-2026:34372 REF https://access.redhat.com/errata/RHSA-2026:36004 REF https://access.redhat.com/errata/RHSA-2026:36005 REF https://access.redhat.com/errata/RHSA-2026:36006 REF https://access.redhat.com/errata/RHSA-2026:41921 REF https://access.redhat.com/errata/RHSA-2026:56786 REF https://access.redhat.com/errata/RHSA-2026:56853 REF https://access.redhat.com/errata/RHSA-2026:56911 REF https://access.redhat.com/errata/RHSA-2026:57402 REF https://access.redhat.com/errata/RHSA-2026:57483 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:59831 REF https://access.redhat.com/errata/RHSA-2026:60019 REF https://access.redhat.com/errata/RHSA-2026:65839 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/security/cve/CVE-2026-33845 REF https://bugzilla.redhat.com/show_bug.cgi?id=2450624 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy