CVE-2026-33845 is an integer underflow in the DTLS handshake parser of GnuTLS. NVD scores it 7.5. Malformed handshake fragments cause an out of bounds read, with information disclosure or denial of service as outcomes. Apply your distribution's fixed GnuTLS package.
What's affected
The record lists GnuTLS, Red Hat Enterprise Linux and Red Hat OpenShift Container Platform. It says a fragment with zero length and a non zero offset triggers an underflow during reassembly, and that the issue is remotely exploitable. The record gives no fixed upstream version, and I could not confirm one, so check the GnuTLS project advisory and your vendor's errata. The record links Red Hat errata RHSA-2026:13274 and others for the fixed packages.
Only software that accepts DTLS is exposed. Plain TLS over TCP does not use the DTLS handshake path.
How to check if you're exposed
gnutls-cli --version
rpm -q gnutls
On Debian or Ubuntu use dpkg -l | grep gnutls. Then find programs that link GnuTLS and speak DTLS, such as VPN servers or WebRTC style services. Distributions backport fixes, so compare against your vendor's advisory, not only the upstream number.
What to do now
- Install your distribution's updated GnuTLS package, per the vendor advisory.
- Restart services that load the library, since running processes keep the old copy.
- Rebuild container images based on affected base images.
- Limit exposure of DTLS services to networks that need them.
Why it matters
The record uses CWE-191, integer underflow. A length calculation drops below zero and wraps to a huge value, so later code reads past the buffer. Protocol parsers that reassemble fragments are a common place for this. The record is not marked as exploited in the wild and is not in CISA KEV.
Parsers for datagram protocols have to cope with lost, duplicated and reordered packets, which is why they contain reassembly code like this. That code does arithmetic on lengths and offsets supplied by the sender, and every such calculation needs a check that it cannot go below zero or past the buffer. When you assess exposure, list the services on each host that terminate DTLS, because those are the processes that need a restart after the library update.
Quick check
Does plain HTTPS use this code?
The flaw is in DTLS handshake parsing, which is not the TCP TLS path.
Sources
Last reviewed: 19 October 2026.
