Introduction
A single malformed DTLS handshake fragment, carrying zero bytes of payload but claiming a non-zero offset, is enough to trigger a heap overrun in GnuTLS and crash any service that relies on it for UDP-based secure communication. This integer underflow in the DTLS reassembly path is tracked as CVE-2026-33845, with a CVSS score of 7.5. It was patched in GnuTLS 3.8.13 on April 29, 2026, together with two other related DTLS vulnerabilities, and the three together reveal significant fragility in the library's fragment-handling logic.
GnuTLS is a free software implementation of the TLS, SSL, and DTLS protocols, and its core cryptographic API is used across numerous Linux distributions and open source projects. It is the default or alternative TLS backend for applications ranging from mail servers to VPN software, so its attack surface covers a broad swath of infrastructure. A vulnerability in its protocol parsing code can ripple out to many downstream consumers.
Technical Information
The vulnerability is in the DTLS handshake fragment reassembly code in GnuTLS. Unlike TLS over TCP, DTLS runs over UDP and must handle message fragmentation and reordering at the protocol level. During the handshake, large messages can be split into fragments, and each fragment is described by a fragment offset and a fragment length. The reassembly logic collects these fragments and reconstructs the original handshake message.
Root Cause
The root cause is improper validation of fragment parameters (CWE-191: Integer Underflow). Suppose a DTLS handshake fragment arrives with a zero length and a non-zero offset, for a handshake message whose total length is non-empty. The reassembly code then performs an arithmetic operation that underflows. The underflow corrupts the calculation of buffer boundaries during reassembly, which in turn causes an out-of-bounds read on the heap.
Attack Flow
The exploitation path is straightforward and requires no authentication:
- An attacker sends a DTLS ClientHello or other handshake initiation to a target service that uses GnuTLS for DTLS.
- During the handshake exchange, the attacker injects a specially crafted handshake fragment. The fragment declares a zero-length payload but specifies a non-zero fragment offset, while the overall handshake message has a non-empty expected length.
- The GnuTLS reassembly code accepts this malformed fragment without adequate validation.
- To compute the remaining bytes to reassemble, the code subtracts the fragment length (zero) from a value derived from the offset and the total message length. Because the length is zero and the offset is not, the result underflows.
- A subsequent memory read uses the underflowed value as a size or index parameter, so the library reads beyond the bounds of the allocated heap buffer.
- This out-of-bounds read can crash the process (denial of service). Depending on heap layout and application behavior, it may also leak portions of heap memory back to the attacker (information disclosure).
DTLS runs over UDP, so the attacker does not need to complete a TCP handshake, which lowers the barrier to exploitation further. A single crafted UDP packet during the initial handshake, before any session is established, can trigger the flaw.
Related Vulnerabilities Fixed in the Same Release
Joshua Rogers of the AISLE Research Team discovered and reported this flaw, and it is tracked under vendor advisory GNUTLS SA 2026 04 29 3. It was patched alongside two other DTLS reassembly vulnerabilities:
| Vulnerability ID | Vendor Advisory | Impact | CVSS Score | Fix Version |
|---|---|---|---|---|
| CVE-2026-33845 | GNUTLS SA 2026 04 29 3 | Remotely triggerable underflow leading to heap overrun | 7.5 High | 3.8.13 |
| CVE-2026-42009 | GNUTLS SA 2026 04 29 2 | Comparator function contract violation causing undefined behavior | 7.5 High | 3.8.13 |
| CVE-2026-33846 | GNUTLS SA 2026 04 29 1 | Missing boundary checks enabling heap overwrite | 7.5 High | 3.8.13 |
That all three needed fixing at the same time shows how complex and fragile the previous DTLS fragment reassembly implementation was.
Affected Systems and Versions
The vulnerability affects GnuTLS versions in the 3.8.x branch prior to 3.8.13. The fix was released in GnuTLS 3.8.13 on April 29, 2026. Any application or service that is linked against a vulnerable version of GnuTLS and accepts DTLS connections is potentially affected. This includes but is not limited to:
- VPN concentrators and gateways using GnuTLS for DTLS tunneling
- WebRTC infrastructure
- IoT gateways and embedded devices
- Mail servers and other network services configured with DTLS support
Red Hat has issued security advisories RHSA-2026:5585 and RHSA-2026:3477 for affected packages in its distribution.
Vendor Security History
GnuTLS maintains a transparent security advisory process and has historically responded rapidly to disclosed vulnerabilities. Version 3.8.13 fixed three related DTLS reassembly flaws (CVE-2026-33845, CVE-2026-42009, and CVE-2026-33846) in one release, a coordinated approach to security hardening. Three distinct vulnerabilities in the same subsystem suggest that the DTLS fragment reassembly code had accumulated technical debt. Even so, the vendor addressed all three in a single release and published clear advisories, which reflects well on its security posture.
