# CVE-2026-42009: GnuTLS denial of service in DTLS packet reordering

Source: https://junglewise.ai/threats/cve-2026-42009-gnutls-denial-of-service-in-dtls-packet-reordering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-18. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-42009 · Severity: high · CVSS 7.5 · Published 2026-05-18

GnuTLS is a widely used security library that enables secure communications over the internet. A flaw in how it handles specific types of network traffic (DTLS) could allow a remote attacker to crash applications or services using the library. This results in a denial of service, potentially disrupting business operations and secure connectivity.

## Quick answers

**Is CVE-2026-42009 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42009 being exploited in the wild.

**How severe is CVE-2026-42009?** High severity, with a CVSS score of 7.5, published 18 May 2026.

**Which products and versions are affected?** GnuTLS gnutls.

**Is there a fix for CVE-2026-42009?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42009 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42009?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability was identified in the GnuTLS Datagram Transport Layer Security (DTLS) implementation. The comparator function used to order DTLS packets by sequence numbers failed to correctly handle duplicate sequence numbers, violating qsort comparator contracts. This flaw can lead to unstable packet ordering or undefined behavior when a remote attacker sends specially crafted DTLS packets. An attacker can exploit this over the network without authentication to trigger a denial of service (DoS) condition. The fix involves ensuring the comparator returns 0 for duplicate sequence numbers and discarding packets with identical sequence numbers but differing handshake types.

## Affected products

- GnuTLS gnutls

## Timeline

- 2026-05-06: other: Reported to Red Hat Bugzilla
- 2026-05-18: disclosed: CVE published

## References

- [https://access.redhat.com/security/cve/CVE-2026-42009](https://access.redhat.com/security/cve/CVE-2026-42009)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2467279](https://bugzilla.redhat.com/show_bug.cgi?id=2467279)