DEBIAN-CVE-2026-42009

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-42009
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42009.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-42009
Upstream
  • CVE-2026-42009
Published
2026-05-18T13:16:32Z
Modified
2026-09-19T22:47:49Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

References

Affected packages

Debian:12 / gnutls28

Package

Name
gnutls28
Purl
pkg:deb/debian/gnutls28?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.7.9-2+deb12u7

Affected versions

3.*
3.7.9-2
3.7.9-2+deb12u1
3.7.9-2+deb12u2
3.7.9-2+deb12u3
3.7.9-2+deb12u4
3.7.9-2+deb12u5
3.7.9-2+deb12u6

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42009.json"

Debian:13 / gnutls28

Package

Name
gnutls28
Purl
pkg:deb/debian/gnutls28?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.8.9-3+deb13u4

Affected versions

3.*
3.8.9-3
3.8.9-3+deb13u1
3.8.9-3+deb13u2
3.8.9-3+deb13u3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42009.json"

Debian:14 / gnutls28

Package

Name
gnutls28
Purl
pkg:deb/debian/gnutls28?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.8.13-1

Affected versions

3.*
3.8.9-3
3.8.10-1
3.8.10-2
3.8.10-3
3.8.11-1
3.8.11-2
3.8.11-3
3.8.12-1
3.8.12-2
3.8.12-3
3.8.12-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42009.json"