CVE-2026-33845 Gnutls: gnutls: denial of service via dtls zero-length fragment
Remote attackers can cause denial of service or information disclosure in GnuTLS via malformed DTLS fragments triggering an integer underflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33845?
CVE-2026-33845 is a high-severity vulnerability in Gnu Gnutls, published on 30 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.
Weakness: CWE-191
Which versions are affected by CVE-2026-33845?
It affects 3 products.
Products include Gnu Gnutls, Redhat Enterprise Linux, Redhat Openshift Container Platform.
How do I fix CVE-2026-33845?
Apply the vendor's patch.
Is CVE-2026-33845 being exploited?
There is no known exploitation of CVE-2026-33845 in the wild and no public exploit code.
Other vulnerabilities in Gnu Gnutls
Sources
Also known as ALPINE-CVE-2026-33845, AZL-85983, BELL-CVE-2026-33845, CLSA-2026-1778172299, CLSA-2026-1778238329, CLSA-2026-1778238907 and 9 more.