# CVE-2026-33846: GnuTLS heap buffer overflow in DTLS handshake reassembly

Source: https://junglewise.ai/threats/cve-2026-33846-gnutls-heap-buffer-overflow-in-dtls-handshake-reassembly  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-33846 · Severity: high · CVSS 7.5 · Published 2026-05-04

A security vulnerability has been identified in GnuTLS, a widely used library that enables secure communications for applications and operating systems. An attacker can exploit this flaw to cause a system crash or potentially corrupt memory by sending specially crafted network packets during the initial connection phase. This could lead to a denial of service, impacting the availability of services that rely on GnuTLS for secure networking.

Technologies: [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-33846 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33846 being exploited in the wild.

**How severe is CVE-2026-33846?** High severity, with a CVSS score of 7.5, published 4 May 2026.

**Which products and versions are affected?** GnuTLS GnuTLS 3.8.13-1, 3.6.16-8.el8_10.6; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 10.

**Is there a fix for CVE-2026-33846?** A patch was published on 2026-05-02: Red Hat released initial security advisory RHSA-2026:13274 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33846 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33846?** Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer overflow exists in the GnuTLS merge_handshake_packet() function within the DTLS handshake fragment reassembly logic. The vulnerability is caused by improper handling of length parameter inconsistency (CWE-130), where the implementation fails to validate that the message_length field remains consistent across all fragments of the same logical message. An attacker can send an initial small fragment to trigger a small buffer allocation, followed by larger fragments with inconsistent length values to perform an out-of-bounds write on the heap. This is remotely exploitable without authentication and can result in application crashes or potential code execution. Patches have been released by Red Hat for RHEL 8, 9, and 10.

## Affected products

- GnuTLS GnuTLS 3.8.13-1, 3.6.16-8.el8_10.6
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10

## Timeline

- 2026-03-24: disclosed: Initial report in Red Hat Bugzilla
- 2026-05-02: patched: Red Hat released initial security advisory RHSA-2026:13274
- 2026-05-04: advisory: NVD published CVE-2026-33846

## References

- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)
- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)
- [https://access.redhat.com/security/cve/CVE-2026-33846](https://access.redhat.com/security/cve/CVE-2026-33846)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2450625](https://bugzilla.redhat.com/show_bug.cgi?id=2450625)

## Related threats

- [Red Hat yggdrasil-worker-package-manager argument injection in APT backend](https://junglewise.ai/threats/cve-2026-18157-red-hat-yggdrasil-worker-package-manager-argument-injection-in)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)