HighFix available
gnutls28 — security advisory
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.
- Products
- gnutls28
- Affected versions
- 3.7.9-2, 3.7.9-2+deb12u1, 3.7.9-2+deb12u2, 3.7.9-2+deb12u3, 3.7.9-2+deb12u4, 3.7.9-2+deb12u5, 3.7.9-2+deb12u6, 3.8.10-1, 3.8.10-2, 3.8.10-3, 3.8.11-1, 3.8.11-2, 3.8.11-3, 3.8.12-1, 3.8.12-2, 3.8.12-3, 3.8.12-4, 3.8.9-3, 3.8.9-3+deb13u1, 3.8.9-3+deb13u2, 3.8.9-3+deb13u3
- Fixed versions
- 3.7.9-2+deb12u7, 3.8.13-1, 3.8.9-3+deb13u4
- CVEs
- CVE-2026-42009
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 17:49 UTC · Revision 1
Source evidence
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.
osv:DEBIAN-CVE-2026-42009
gnutls28
Fixed versions: 3.7.9-2+deb12u7
gnutls28
Fixed versions: 3.8.9-3+deb13u4
gnutls28
Fixed versions: 3.8.13-1
Complete source record
{
"id": "ad218afd274be09f340d23c44fd7ce3433d5c37426b4fcc42e54d2fba946d670",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-42009",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-42009",
"summary": "A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.",
"evidence": "osv:DEBIAN-CVE-2026-42009",
"products": [
{
"name": {
"value": "gnutls28",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.9-2+deb12u7",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "3.7.9-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.7.9-2+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "3.7.9-2+deb12u2",
"evidence": "/affected/0/versions"
},
{
"value": "3.7.9-2+deb12u3",
"evidence": "/affected/0/versions"
},
{
"value": "3.7.9-2+deb12u4",
"evidence": "/affected/0/versions"
},
{
"value": "3.7.9-2+deb12u5",
"evidence": "/affected/0/versions"
},
{
"value": "3.7.9-2+deb12u6",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "gnutls28",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.8.9-3+deb13u4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "3.8.9-3",
"evidence": "/affected/1/versions"
},
{
"value": "3.8.9-3+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "3.8.9-3+deb13u2",
"evidence": "/affected/1/versions"
},
{
"value": "3.8.9-3+deb13u3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "gnutls28",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.8.13-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "3.8.10-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.10-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.10-3",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.11-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.11-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.11-3",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.12-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.12-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.12-3",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.12-4",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.9-3",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2026-42009",
"aliases": [
"DEBIAN-CVE-2026-42009"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.9-2+deb12u7"
}
]
}
],
"package": {
"name": "gnutls28",
"purl": "pkg:deb/debian/gnutls28?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.7.9-2",
"3.7.9-2+deb12u1",
"3.7.9-2+deb12u2",
"3.7.9-2+deb12u3",
"3.7.9-2+deb12u4",
"3.7.9-2+deb12u5",
"3.7.9-2+deb12u6"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42009.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.9-3+deb13u4"
}
]
}
],
"package": {
"name": "gnutls28",
"purl": "pkg:deb/debian/gnutls28?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.8.9-3",
"3.8.9-3+deb13u1",
"3.8.9-3+deb13u2",
"3.8.9-3+deb13u3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42009.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.13-1"
}
]
}
],
"package": {
"name": "gnutls28",
"purl": "pkg:deb/debian/gnutls28?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.8.10-1",
"3.8.10-2",
"3.8.10-3",
"3.8.11-1",
"3.8.11-2",
"3.8.11-3",
"3.8.12-1",
"3.8.12-2",
"3.8.12-3",
"3.8.12-4",
"3.8.9-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42009.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-31T09:47:37.556289390Z",
"provider": "osv",
"upstream": [
"CVE-2026-42009"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-42009"
]
},
"related_cves": [
{
"value": "CVE-2026-42009",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 461289,
"published_at": "2026-05-18T13:16:32.707+00:00"
}