Executive brief
GnuTLS is a widely used security library that enables secure communications over the internet. A flaw in how it handles specific types of network traffic (DTLS) could allow a remote attacker to crash applications or services using the library. This results in a denial of service, potentially disrupting business operations and secure connectivity.
Technical details
A vulnerability was identified in the GnuTLS Datagram Transport Layer Security (DTLS) implementation. The comparator function used to order DTLS packets by sequence numbers failed to correctly handle duplicate sequence numbers, violating qsort comparator contracts. This flaw can lead to unstable packet ordering or undefined behavior when a remote attacker sends specially crafted DTLS packets. An attacker can exploit this over the network without authentication to trigger a denial of service (DoS) condition. The fix involves ensuring the comparator returns 0 for duplicate sequence numbers and discarding packets with identical sequence numbers but differing handshake types.
Affected products
- GnuTLS gnutls
Timeline
- 2026-05-06: other: Reported to Red Hat Bugzilla
- 2026-05-18: disclosed: CVE published