Strix
26.1K

CVE-2026-33845

CRITICALCVSS 9.1/10EPSS 0.80%

Last modified

CVE-2026-33845 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.. EPSS estimates a 0.80% chance of exploitation in the next 30 days.

Description

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

Metrics

CVSS 3.1
9.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS Probability
0.80%

52.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
GnuGnutlsAll versions
RedhatOpenshift Container Platform4.0
RedhatEnterprise Linux6.0
RedhatEnterprise Linux7.0
RedhatEnterprise Linux8.0
RedhatEnterprise Linux9.0
RedhatEnterprise Linux10.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2026-33845?
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.
How severe is CVE-2026-33845?
CVE-2026-33845 has a CVSS score of 9.1/10 (CRITICAL severity). The EPSS model estimates a 0.80% probability of exploitation in the next 30 days.
How do I fix CVE-2026-33845?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-33845?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST