Gnutls — CraftedSignal Threat Feed

GnuTLS DTLS Handshake Parsing Flaw (CVE-2026-33845)

hello@craftedsignal.io — Thu, 30 Apr 2026 18:16:28 +0000

CVE-2026-33845 describes a vulnerability in the GnuTLS library related to the parsing of DTLS handshake fragments. The vulnerability stems from improper handling of malformed fragments that have a zero length but a non-zero offset. This leads to an integer underflow during the reassembly process, which then triggers an out-of-bounds read. The vulnerability is remotely exploitable, meaning an attacker could potentially trigger it without needing local access. Successful exploitation can lead to information disclosure or a denial-of-service condition. The affected component is the GnuTLS library, which is used by various applications for secure communication.

Attack Chain

An attacker crafts a malicious DTLS handshake fragment with a zero length and non-zero offset.
The attacker sends the malformed DTLS handshake fragment to a vulnerable GnuTLS server.
The GnuTLS library receives the fragment and begins the reassembly process.
The integer underflow occurs when calculating the correct offset for the fragment reassembly.
The integer underflow leads to an out-of-bounds memory read operation.
The out-of-bounds read allows the attacker to potentially read sensitive information from the server’s memory.
Alternatively, the out-of-bounds read may cause the server to crash, resulting in a denial-of-service.
The attacker achieves either information disclosure or denial-of-service based on the server’s response to the out-of-bounds read.

Impact

Successful exploitation of CVE-2026-33845 can lead to a denial-of-service condition, impacting the availability of services relying on the vulnerable GnuTLS library. The out-of-bounds read can also potentially expose sensitive information from the server’s memory, leading to data breaches. Given the widespread use of GnuTLS in various applications, a successful widespread attack could affect numerous organizations and users.

Recommendation

Apply available patches for GnuTLS provided by Red Hat or other vendors to address CVE-2026-33845.
Monitor network traffic for malformed DTLS handshake fragments with zero length and non-zero offset that may indicate exploitation attempts targeting CVE-2026-33845.
Deploy the Sigma rule DetectGnuTLSDTLSMalformedFragment to identify suspicious network connections associated with the vulnerability.

GNUTLS Denial of Service via Malformed ClientHello (CVE-2026-1584)

hello@craftedsignal.io — Thu, 09 Apr 2026 18:16:44 +0000

CVE-2026-1584 is a vulnerability found in the gnutls library, a widely used implementation of the TLS protocol. This vulnerability allows an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition on a server utilizing a vulnerable version of gnutls. The attack involves sending a specially crafted TLS ClientHello message containing an invalid Pre-Shared Key (PSK) binder value. This malformed message triggers a NULL pointer dereference within the gnutls library, leading to a server crash. The vulnerability was reported on April 9, 2026, and affects systems using gnutls for TLS communication. This vulnerability poses a significant risk to services relying on gnutls for secure communication, potentially disrupting availability and impacting users.

Attack Chain

Attacker identifies a server utilizing a vulnerable version of gnutls.
Attacker crafts a TLS ClientHello message.
Attacker modifies the ClientHello message to include an invalid Pre-Shared Key (PSK) binder value.
Attacker sends the crafted ClientHello message to the target server.
The server’s gnutls library processes the malformed ClientHello message.
Due to the invalid PSK binder, a NULL pointer dereference occurs within gnutls.
The NULL pointer dereference causes the gnutls process to crash.
The server becomes unavailable, resulting in a denial-of-service condition.

Impact

Successful exploitation of CVE-2026-1584 leads to a denial-of-service condition, rendering the affected server unavailable. The impact is service disruption for any application relying on the vulnerable gnutls instance. There is no specific victim count available; however, any server using a vulnerable version of gnutls is susceptible. The vulnerable software is used across multiple sectors, including web servers, mail servers, and VPN gateways. A successful attack disrupts TLS communication, preventing users from accessing services.

Recommendation

Monitor network traffic for malformed TLS ClientHello messages containing invalid PSK binder values to detect potential exploitation attempts. (See Sigma rule “Detect Malformed TLS ClientHello with Invalid PSK Binder”)
Upgrade to a patched version of gnutls that addresses CVE-2026-1584 to remediate the vulnerability.
Implement rate limiting on TLS connections to mitigate the impact of DoS attacks.
Enable verbose logging on TLS connections to aid in the detection and analysis of exploitation attempts (e.g., webserver logs).

GnuTLS DTLS Handshake Heap Overflow Vulnerability (CVE-2026-33846)

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

A heap buffer overflow vulnerability has been identified in the DTLS handshake fragment reassembly logic of GnuTLS. The vulnerability, tracked as CVE-2026-33846, resides within the merge_handshake_packet() function. This function is responsible for matching and merging incoming DTLS handshake fragments. The core issue is the lack of validation for the message_length field across different fragments belonging to the same logical message. An attacker can exploit this flaw by transmitting malicious DTLS fragments that contain inconsistent message_length values. This inconsistency leads the GnuTLS implementation to allocate a buffer based on a smaller, initial fragment but subsequently attempts to write data beyond the allocated buffer’s boundaries using the larger, conflicting fragments. This out-of-bounds write on the heap can be triggered remotely without requiring any form of authentication, making it a critical vulnerability. Successful exploitation can lead to application crashes or, potentially, arbitrary memory corruption.

Attack Chain

Attacker initiates a DTLS handshake with a vulnerable GnuTLS server.
The attacker sends a first DTLS handshake fragment with a small message_length value.
The vulnerable merge_handshake_packet() function allocates a heap buffer based on the initial, smaller message_length.
Attacker sends a subsequent DTLS handshake fragment for the same handshake message with a larger, inconsistent message_length value.
merge_handshake_packet() incorrectly merges the second fragment into the allocated buffer without proper bounds checking.
The write operation overflows the allocated heap buffer, corrupting adjacent memory.
The application crashes due to memory corruption, or the attacker potentially gains further control.

Impact

Successful exploitation of CVE-2026-33846 can lead to denial-of-service conditions due to application crashes. Memory corruption could allow for arbitrary code execution, but this is a less likely outcome. Given the widespread use of GnuTLS in various applications and systems, a large number of services could be impacted.

Recommendation

Monitor network traffic for DTLS handshakes with inconsistent message_length values in fragmented handshake messages using the provided Sigma rule Detect DTLS Handshake Fragment Length Mismatch.
Apply available patches from GnuTLS to remediate CVE-2026-33846.
Implement rate limiting for DTLS handshake requests to mitigate potential denial-of-service attacks.