CVE-2026-42009: Gnutls: gnutls: denial of service via dtls packet reordering vulnerability
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.
Other sources
Gnutls: gnutls: denial of service via dtls packet reordering vulnerability
— Microsoft
The comparator function used for ordering DTLS packets by sequence numbers did not follow qsort comparator contracts in case of packets with duplicate sequence numbers, which could lead to unstable ordering or undefined behaviour. Return 0 in such cases makes the sorting stable. Additionally, discard packets with same sequence numbers and differing handshake type, so that they don't end up being sorted in the first place.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.7.1-5+deb11u10Fixed in 3.7.9-2+deb12u7Fixed in 3.8.9-3+deb13u4Fixed in 3.8.13-1 - Configuration
Update GnuTLS DTLS packet reordering logic to discard DTLS packets that have the same sequence number but a different handshake type so they do not get sorted; ensure the DTLS DTLS packet sequence-number comparator returns 0 for these cases to keep sorting stable and avoid qsort comparator contract violations/undefined behavior.
GnuTLS (DTLS) packet reordering logic DTLS packet discard/reorder behavior for duplicate sequence numbers = Discard packets with same sequence numbers and differing handshake type; treat such cases as comparator returns 0 so sorting remains stable
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42009?
CVE-2026-42009 has been classified as a moderate severity vulnerability due to its potential to cause denial of service.
How can I fix CVE-2026-42009?
To fix CVE-2026-42009, update GnuTLS to the latest version where the vulnerability has been patched.
What kind of attack is possible with CVE-2026-42009?
CVE-2026-42009 allows remote attackers to exploit a denial of service condition through DTLS packet reordering.
Which software is affected by CVE-2026-42009?
CVE-2026-42009 affects GnuTLS software, specifically versions that utilize Datagram Transport Layer Security.
Is CVE-2026-42009 a widespread vulnerability?
The impact of CVE-2026-42009 may vary, but it primarily affects systems relying on GnuTLS for DTLS functionality.