CVE-2026-42009: Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

Published May 6, 2026
·
Updated

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

Other sources

Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

Microsoft

The comparator function used for ordering DTLS packets by sequence numbers did not follow qsort comparator contracts in case of packets with duplicate sequence numbers, which could lead to unstable ordering or undefined behaviour. Return 0 in such cases makes the sorting stable. Additionally, discard packets with same sequence numbers and differing handshake type, so that they don't end up being sorted in the first place.

Red Hat

Affected Software

47 affected componentsFixes available
GNUTLS GNUTLS
Microsoft azl3 gnutls 3.8.3-8
Microsoft azl3 gnutls 3.8.3-11
GNU GnuTLS
redhat Hardened Images
redhat OpenShift Container Platform=4.0
redhat Enterprise Linux=6.0
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
redhat Enterprise Linux=8.0
redhat Enterprise Linux For Els=8.10
redhat Enterprise Linux For Els=8.10
redhat Enterprise Linux For Ibm Z Systems=8.0_s390x
redhat Enterprise Linux For Ibm Z Systems Els=8.10
redhat Enterprise Linux For Power Little Endian=8.0_ppc64le
redhat Enterprise Linux For Power Little Endian Els=8.10
redhat Enterprise Linux=9.0
redhat Enterprise Linux=9.0
redhat Enterprise Linux=9.8
redhat Enterprise Linux For Els=9.8
redhat Enterprise Linux For Els=9.8
redhat Enterprise Linux For Eus=9.8
redhat Enterprise Linux For Eus=9.8
redhat Enterprise Linux For Ibm Z Systems=9.0_s390x
redhat Enterprise Linux For Ibm Z Systems Els=9.8
redhat Enterprise Linux For Ibm Z Systems Eus=9.8
redhat Enterprise Linux For Power Little Endian=9.0_ppc64le
redhat Enterprise Linux For Power Little Endian Els=9.8
redhat Enterprise Linux For Power Little Endian Eus=9.8
redhat Enterprise Linux For Update Services For Sap Solutions=9.8
redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions=9.8
redhat Enterprise Linux=10.0
redhat Enterprise Linux=10.0
redhat Enterprise Linux=10.2
redhat Enterprise Linux=10.2
redhat Enterprise Linux For Els=10.2
redhat Enterprise Linux For Els=10.2
redhat Enterprise Linux For Eus=10.2
redhat Enterprise Linux For Eus=10.2
redhat Enterprise Linux For Ibm Z Systems=10.2
redhat Enterprise Linux For Ibm Z Systems Els=10.2
redhat Enterprise Linux For Ibm Z Systems Eus=10.2
redhat Enterprise Linux For Power Little Endian=10.0
redhat Enterprise Linux For Power Little Endian=10.2
redhat Enterprise Linux For Power Little Endian Els=10.2
redhat Enterprise Linux For Power Little Endian Eus=10.2
debian/gnutls28<=3.7.1-5+deb11u5, <=3.7.9-2+deb12u6, <=3.8.9-3+deb13u3
3.7.1-5+deb11u103.7.9-2+deb12u73.8.9-3+deb13u43.8.13-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/gnutls28 to a version that resolves this vulnerability.

    Fixed in 3.7.1-5+deb11u10Fixed in 3.7.9-2+deb12u7Fixed in 3.8.9-3+deb13u4Fixed in 3.8.13-1
  2. Configuration

    Update GnuTLS DTLS packet reordering logic to discard DTLS packets that have the same sequence number but a different handshake type so they do not get sorted; ensure the DTLS DTLS packet sequence-number comparator returns 0 for these cases to keep sorting stable and avoid qsort comparator contract violations/undefined behavior.

    GnuTLS (DTLS) packet reordering logic DTLS packet discard/reorder behavior for duplicate sequence numbers = Discard packets with same sequence numbers and differing handshake type; treat such cases as comparator returns 0 so sorting remains stable

Event History

May 6, 2026
Data Sourced
via Red Hat·04:35 PM
DescriptionSeverityAffected Software
May 18, 2026
CVE Published
via MITRE·12:44 PM
Data Sourced
via MITRE·12:44 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeaknessAffected Software
May 23, 2026
Data Sourced
via Microsoft·08:01 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:01 AM
Affected Software
Updated
via Microsoft·08:01 AM
DescriptionSeverity
Jul 7, 2026
Data Sourced
via Ubuntu·04:33 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·04:35 PM
DescriptionAffected Software
Jul 8, 2026
Data Sourced
via Launchpad·04:36 PM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-42009?

CVE-2026-42009 has been classified as a moderate severity vulnerability due to its potential to cause denial of service.

2

How can I fix CVE-2026-42009?

To fix CVE-2026-42009, update GnuTLS to the latest version where the vulnerability has been patched.

3

What kind of attack is possible with CVE-2026-42009?

CVE-2026-42009 allows remote attackers to exploit a denial of service condition through DTLS packet reordering.

4

Which software is affected by CVE-2026-42009?

CVE-2026-42009 affects GnuTLS software, specifically versions that utilize Datagram Transport Layer Security.

5

Is CVE-2026-42009 a widespread vulnerability?

The impact of CVE-2026-42009 may vary, but it primarily affects systems relying on GnuTLS for DTLS functionality.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203