gnutls28 — security advisory
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.
- Products
- gnutls28
- Affected versions
- 3.7.9-2, 3.7.9-2+deb12u1, 3.7.9-2+deb12u2, 3.7.9-2+deb12u3, 3.7.9-2+deb12u4, 3.7.9-2+deb12u5, 3.7.9-2+deb12u6, 3.8.10-1, 3.8.10-2, 3.8.10-3, 3.8.11-1, 3.8.11-2, 3.8.11-3, 3.8.12-1, 3.8.12-2, 3.8.12-3, 3.8.12-4, 3.8.9-3, 3.8.9-3+deb13u1, 3.8.9-3+deb13u2, 3.8.9-3+deb13u3
- Fixed versions
- 3.7.9-2+deb12u7, 3.8.13-1, 3.8.9-3+deb13u4
- CVEs
- CVE-2026-33846
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 17:41 UTC · Revision 1
Source evidence
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.
osv:DEBIAN-CVE-2026-33846
gnutls28
Fixed versions: 3.7.9-2+deb12u7
gnutls28
Fixed versions: 3.8.9-3+deb13u4
gnutls28
Fixed versions: 3.8.13-1
Complete source record
{
"id": "1c225e975af566a811d44664ac81f30a089c2a563fd36d2b960ae90e694aa878",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-33846",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-33846",
"summary": "A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.",
"evidence": "osv:DEBIAN-CVE-2026-33846",
"products": [
{
"name": {
"value": "gnutls28",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.7.9-2+deb12u7",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "3.7.9-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.7.9-2+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "3.7.9-2+deb12u2",
"evidence": "/affected/0/versions"
},
{
"value": "3.7.9-2+deb12u3",
"evidence": "/affected/0/versions"
},
{
"value": "3.7.9-2+deb12u4",
"evidence": "/affected/0/versions"
},
{
"value": "3.7.9-2+deb12u5",
"evidence": "/affected/0/versions"
},
{
"value": "3.7.9-2+deb12u6",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "gnutls28",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.8.9-3+deb13u4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "3.8.9-3",
"evidence": "/affected/1/versions"
},
{
"value": "3.8.9-3+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "3.8.9-3+deb13u2",
"evidence": "/affected/1/versions"
},
{
"value": "3.8.9-3+deb13u3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "gnutls28",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.8.13-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "3.8.10-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.10-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.10-3",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.11-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.11-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.11-3",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.12-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.12-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.12-3",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.12-4",
"evidence": "/affected/2/versions"
},
{
"value": "3.8.9-3",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2026-33846",
"aliases": [
"DEBIAN-CVE-2026-33846"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.9-2+deb12u7"
}
]
}
],
"package": {
"name": "gnutls28",
"purl": "pkg:deb/debian/gnutls28?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.7.9-2",
"3.7.9-2+deb12u1",
"3.7.9-2+deb12u2",
"3.7.9-2+deb12u3",
"3.7.9-2+deb12u4",
"3.7.9-2+deb12u5",
"3.7.9-2+deb12u6"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33846.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.9-3+deb13u4"
}
]
}
],
"package": {
"name": "gnutls28",
"purl": "pkg:deb/debian/gnutls28?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.8.9-3",
"3.8.9-3+deb13u1",
"3.8.9-3+deb13u2",
"3.8.9-3+deb13u3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33846.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.13-1"
}
]
}
],
"package": {
"name": "gnutls28",
"purl": "pkg:deb/debian/gnutls28?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.8.10-1",
"3.8.10-2",
"3.8.10-3",
"3.8.11-1",
"3.8.11-2",
"3.8.11-3",
"3.8.12-1",
"3.8.12-2",
"3.8.12-3",
"3.8.12-4",
"3.8.9-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33846.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-27T09:47:31.911757397Z",
"provider": "osv",
"upstream": [
"CVE-2026-33846"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-33846"
]
},
"related_cves": [
{
"value": "CVE-2026-33846",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 460991,
"published_at": "2026-05-04T10:15:59.69+00:00"
}