CVE-2026-42009 Gnutls: gnutls: denial of service via dtls packet reordering vulnerability
A remote attacker can cause a denial of service in GnuTLS by exploiting a flaw in DTLS packet reordering logic that mishandles duplicate sequence numbers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42009?
CVE-2026-42009 is a high-severity denial of service vulnerability in Gnu Gnutls, published on 18 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.
Weakness: CWE-475
Which versions are affected by CVE-2026-42009?
It affects 14 products.
Products include Gnu Gnutls, Redhat Enterprise Linux, Redhat Enterprise Linux for Els, Redhat Enterprise Linux for Eus, Redhat Enterprise Linux for Ibm Z Systems, Redhat Enterprise Linux for Ibm Z Systems Els and 8 more.
How do I fix CVE-2026-42009?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-42009 being exploited?
There is no known exploitation of CVE-2026-42009 in the wild and no public exploit code.
Other vulnerabilities in Gnu Gnutls
Sources
Also known as ALPINE-CVE-2026-42009, AZL-87110, BELL-CVE-2026-42009, DEBIAN-CVE-2026-42009, ECHO-b6c2-c0e5-0816, GHSA-9gx7-g5hv-xjjj.