Vulnerability CVE-2026-33845: Information

Description

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

Severity: CRITICAL (9.1)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33845

Published: April 30, 2026

Modified: May 5, 2026

Error type identifier: CWE-191

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
gnutls30	sisyphus	3.8.13-alt1	3.8.13-alt1	ALT-PU-2026-7123-1	417120	Fixed
gnutls30	p11	3.8.13-alt1	3.8.13-alt1	ALT-PU-2026-7127-2	417121	Fixed
gnutls30	p10	3.6.16-alt11	3.6.16-alt10	ALT-PU-2026-7344-1	417556	Testing
gnutls30	c10f2	3.6.16-alt11	3.6.16-alt10	ALT-PU-2026-7348-1	417557	Testing

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://access.redhat.com/errata/RHSA-2026:13274	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33845	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2450624	Issue Tracking Vendor Advisory

Affected configurations:
1. cpe:2.3:a:gnu:gnutls:-:*:*:*:*:*:*:*
  cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

Version: v26.2.2