PT-2026-36149 · Gnu+3 · Gnutls+3

Osidb Bzimport · Published 2026-04-30 · Updated 2026-06-01 · CVE-2026-33845

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions GnuTLS (affected versions not specified)

Description A flaw in DTLS handshake parsing allows malformed fragments with zero length and non-zero offset to cause an integer underflow during reassembly. This leads to an out-of-bounds read, which is remotely exploitable and may result in information disclosure or denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

ALSA-2026:20611

CVE-2026-33845

ECHO-638C-85AD-8D98

OESA-2026-2221

OPENSUSE-SU-2026:10691-1

RHSA-2026:13274

USN-8284-1

Affected Products

Gnutls

Linuxmint

Rocky Linux

Ubuntu

References · 76

• https://ubuntu.com/security/CVE-2026-42013 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5419 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-20611.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33845 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-33845 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33846 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-33845 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3833 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8284-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42012 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33845 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2450624 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42009 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:20612 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42014 · Vendor Advisory