CVE-2026-42009
HIGHCVSS 7.5/10EPSS 1.33%
Last modified
CVE-2026-42009 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. EPSS estimates a 1.33% chance of exploitation in the next 30 days.
Description
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Gnutls | All versions |
| Redhat | Hardened Images | All versions |
| Redhat | Openshift Container Platform | 4.0 |
| Redhat | Enterprise Linux | 6.0 |
| Redhat | Enterprise Linux | 7.0 |
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Linux For Els | 8.10 |
| Redhat | Enterprise Linux For Ibm Z Systems | 8.0_s390x |
| Redhat | Enterprise Linux For Ibm Z Systems Els | 8.10 |
| Redhat | Enterprise Linux For Power Little Endian | 8.0_ppc64le |
| Redhat | Enterprise Linux For Power Little Endian Els | 8.10 |
| Redhat | Enterprise Linux | 9.0 |
| Redhat | Enterprise Linux | 9.8 |
| Redhat | Enterprise Linux For Els | 9.8 |
| Redhat | Enterprise Linux For Eus | 9.8 |
| Redhat | Enterprise Linux For Ibm Z Systems | 9.0_s390x |
| Redhat | Enterprise Linux For Ibm Z Systems Els | 9.8 |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | 9.8 |
| Redhat | Enterprise Linux For Power Little Endian | 9.0_ppc64le |
| Redhat | Enterprise Linux For Power Little Endian Els | 9.8 |
| Redhat | Enterprise Linux For Power Little Endian Eus | 9.8 |
| Redhat | Enterprise Linux For Update Services For Sap Solutions | 9.8 |
| Redhat | Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions | 9.8 |
| Redhat | Enterprise Linux | 10.0 |
| Redhat | Enterprise Linux | 10.2 |
| Redhat | Enterprise Linux For Els | 10.2 |
| Redhat | Enterprise Linux For Eus | 10.2 |
| Redhat | Enterprise Linux For Ibm Z Systems | 10.2 |
| Redhat | Enterprise Linux For Ibm Z Systems Els | 10.2 |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | 10.2 |
| Redhat | Enterprise Linux For Power Little Endian | 10.0 |
| Redhat | Enterprise Linux For Power Little Endian | 10.2 |
| Redhat | Enterprise Linux For Power Little Endian Els | 10.2 |
| Redhat | Enterprise Linux For Power Little Endian Eus | 10.2 |
References
- https://access.redhat.com/errata/RHSA-2026:13274Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:20611Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:20612Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:20613Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-42009Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467279Issue Tracking, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:13274Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:20611Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:20612Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:20613Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-42009Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467279Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-42009?
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.
How severe is CVE-2026-42009?
CVE-2026-42009 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.33% probability of exploitation in the next 30 days.
How do I fix CVE-2026-42009?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-42000Insufficient Validation of Names During AXFR8.6
- CVE-2026-42001Insufficient Validation of Autoprimary SOA Queries7.5
- CVE-2026-42002Concurrency and locking defects in GSS-TSIG7.5
- CVE-2026-42004An attacker can send a crafted EDNS OPT record that will be …3.7
- CVE-2026-42005An attacker can send a web request that causes unlimited mem…4.3
- CVE-2026-42006An attacker can cause uncontrolled memory usage with excessi…4.3
- CVE-2026-4201A weakness has been identified in glowxq glowxq-oj up to 6f7…7.3
- CVE-2026-42010A flaw was found in gnutls. Servers configured with RSA-PSK …9.8
- CVE-2026-42011A flaw was found in gnutls. This vulnerability occurs becaus…7.4
- CVE-2026-42012A flaw was found in gnutls. A remote attacker could exploit …7.1
- CVE-2026-42013A flaw was found in gnutls. When validating certificates, an…8.2
- CVE-2026-42014A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin…6.6
Are you affected by CVE-2026-42009?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST