CVE-2026-33846: Improper Handling of Length Parameter Inconsistency in Red Hat Red Hat Enterprise Linux 10
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.
AI Analysis
Technical Summary
The vulnerability in GnuTLS arises from improper handling of inconsistent length parameters during DTLS handshake fragment reassembly. Specifically, merge_handshake_packet() merges fragments solely based on handshake type and does not ensure that the message_length field is consistent across all fragments of the same logical message. This allows an attacker to send DTLS fragments with conflicting message_length values, causing the system to allocate a buffer based on a smaller fragment and then write beyond its bounds when processing larger fragments. This heap buffer overflow is remotely exploitable without authentication via the DTLS handshake path and can cause application crashes or memory corruption. Red Hat has acknowledged this issue (CVE-2026-33846) and issued advisories for related products, including Red Hat Enterprise Linux 8, where patches are available. However, the provided advisory for Red Hat Enterprise Linux 10 does not explicitly confirm a patch or remediation status.
Potential Impact
The vulnerability enables remote attackers to cause a denial of service (application crash) or potentially memory corruption by sending crafted DTLS handshake fragments with inconsistent message_length values. It is exploitable without authentication over the network. The CVSS 3.1 base score is 7.5 (High), with the impact vector indicating no confidentiality or integrity loss but high availability impact.
Mitigation Recommendations
Red Hat has released security advisories and updates for GnuTLS addressing this vulnerability in Red Hat Enterprise Linux 8 and related products. For Red Hat Enterprise Linux 10, the vendor advisory does not explicitly confirm a patch or remediation status. Users should monitor the official Red Hat security advisory page for updates and apply available GnuTLS updates as soon as they are released. Until a fix is applied, consider limiting exposure of DTLS services to untrusted networks. Patch status is not yet confirmed for Red Hat Enterprise Linux 10 — check the vendor advisory https://access.redhat.com/security/cve/CVE-2026-33846 for current remediation guidance.
CVE-2026-33846: Improper Handling of Length Parameter Inconsistency in Red Hat Red Hat Enterprise Linux 10
Description
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.
CVSS v3.1
Score 7.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in GnuTLS arises from improper handling of inconsistent length parameters during DTLS handshake fragment reassembly. Specifically, merge_handshake_packet() merges fragments solely based on handshake type and does not ensure that the message_length field is consistent across all fragments of the same logical message. This allows an attacker to send DTLS fragments with conflicting message_length values, causing the system to allocate a buffer based on a smaller fragment and then write beyond its bounds when processing larger fragments. This heap buffer overflow is remotely exploitable without authentication via the DTLS handshake path and can cause application crashes or memory corruption. Red Hat has acknowledged this issue (CVE-2026-33846) and issued advisories for related products, including Red Hat Enterprise Linux 8, where patches are available. However, the provided advisory for Red Hat Enterprise Linux 10 does not explicitly confirm a patch or remediation status.
Potential Impact
The vulnerability enables remote attackers to cause a denial of service (application crash) or potentially memory corruption by sending crafted DTLS handshake fragments with inconsistent message_length values. It is exploitable without authentication over the network. The CVSS 3.1 base score is 7.5 (High), with the impact vector indicating no confidentiality or integrity loss but high availability impact.
Mitigation Recommendations
Red Hat has released security advisories and updates for GnuTLS addressing this vulnerability in Red Hat Enterprise Linux 8 and related products. For Red Hat Enterprise Linux 10, the vendor advisory does not explicitly confirm a patch or remediation status. Users should monitor the official Red Hat security advisory page for updates and apply available GnuTLS updates as soon as they are released. Until a fix is applied, consider limiting exposure of DTLS services to untrusted networks. Patch status is not yet confirmed for Red Hat Enterprise Linux 10 — check the vendor advisory https://access.redhat.com/security/cve/CVE-2026-33846 for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-03-24T05:31:54.914Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-33846","vendor":"Red Hat"}]
Threat ID: 69f899d7cbff5d86101f24a0
Added to database: 05/04/2026, 13:06:31 UTC
Last enriched: 07/23/2026, 22:36:06 UTC
Last updated: 08/02/2026, 19:17:58 UTC
Views: 111
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.