Skip to content
Heist/ feed
UnratedFix available

ALPINE-CVE-2026-33846

Type: advisorySource: OSV1 source record

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Announced Source revision 1
Original source ↗

ALPINE-CVE-2026-33846

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:ALPINE-CVE-2026-33846

gnutls

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
3.8.13-r0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

gnutls

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
3.8.13-r0

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

gnutls

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
3.8.13-r0

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

gnutls

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
3.8.13-r0

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

gnutls

Source reference: /affected/4/package/name

Affected versions
Not stated in this record
Fixed versions
3.8.13-r0

Source reference: /affected/4/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.8.13-r0"
          }
        ]
      }
    ],
    "package": {
      "name": "gnutls",
      "purl": "pkg:apk/alpine/gnutls?arch=source",
      "ecosystem": "Alpine:v3.20"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-33846.json"
    },
    "ecosystem_specific": {}
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.8.13-r0"
          }
        ]
      }
    ],
    "package": {
      "name": "gnutls",
      "purl": "pkg:apk/alpine/gnutls?arch=source",
      "ecosystem": "Alpine:v3.21"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-33846.json"
    },
    "ecosystem_specific": {}
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.8.13-r0"
          }
        ]
      }
    ],
    "package": {
      "name": "gnutls",
      "purl": "pkg:apk/alpine/gnutls?arch=source",
      "ecosystem": "Alpine:v3.22"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-33846.json"
    },
    "ecosystem_specific": {}
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.8.13-r0"
          }
        ]
      }
    ],
    "package": {
      "name": "gnutls",
      "purl": "pkg:apk/alpine/gnutls?arch=source",
      "ecosystem": "Alpine:v3.23"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-33846.json"
    },
    "ecosystem_specific": {}
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.8.13-r0"
          }
        ]
      }
    ],
    "package": {
      "name": "gnutls",
      "purl": "pkg:apk/alpine/gnutls?arch=source",
      "ecosystem": "Alpine:v3.24"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-33846.json"
    },
    "ecosystem_specific": {}
  }
]

Publisher severity

No explicit severity was provided.

Event
#54284 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement