CVE-2026-42009

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.
References
Link Resource
https://access.redhat.com/errata/RHSA-2026:13274 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:20611 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:20612 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:20613 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:26319
https://access.redhat.com/errata/RHSA-2026:26409
https://access.redhat.com/errata/RHSA-2026:29197
https://access.redhat.com/errata/RHSA-2026:29794
https://access.redhat.com/errata/RHSA-2026:30004
https://access.redhat.com/errata/RHSA-2026:30849
https://access.redhat.com/errata/RHSA-2026:30850
https://access.redhat.com/errata/RHSA-2026:32962
https://access.redhat.com/errata/RHSA-2026:33125
https://access.redhat.com/errata/RHSA-2026:34372
https://access.redhat.com/errata/RHSA-2026:34764
https://access.redhat.com/errata/RHSA-2026:34788
https://access.redhat.com/errata/RHSA-2026:36004
https://access.redhat.com/errata/RHSA-2026:36005
https://access.redhat.com/errata/RHSA-2026:36006
https://access.redhat.com/errata/RHSA-2026:41921
https://access.redhat.com/security/cve/CVE-2026-42009 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467279 Issue Tracking Third Party Advisory
https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2
https://access.redhat.com/errata/RHSA-2026:13274 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:20611 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:20612 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:20613 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:26319
https://access.redhat.com/errata/RHSA-2026:26409
https://access.redhat.com/errata/RHSA-2026:29197
https://access.redhat.com/errata/RHSA-2026:29794
https://access.redhat.com/errata/RHSA-2026:30004
https://access.redhat.com/errata/RHSA-2026:30849
https://access.redhat.com/errata/RHSA-2026:30850
https://access.redhat.com/errata/RHSA-2026:32962
https://access.redhat.com/errata/RHSA-2026:33125
https://access.redhat.com/errata/RHSA-2026:34372
https://access.redhat.com/errata/RHSA-2026:34764
https://access.redhat.com/errata/RHSA-2026:34788
https://access.redhat.com/errata/RHSA-2026:36004
https://access.redhat.com/errata/RHSA-2026:36005
https://access.redhat.com/errata/RHSA-2026:36006
https://access.redhat.com/errata/RHSA-2026:41921
https://access.redhat.com/security/cve/CVE-2026-42009 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467279 Issue Tracking Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gnu:gnutls:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_els:8.10:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_els:8.10:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:8.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:8.10:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux:9.8:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_els:9.8:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_els:9.8:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_eus:9.8:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_eus:9.8:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:9.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:9.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_update_services_for_sap_solutions:9.8:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.8:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:10.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:10.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.2:*:*:*:*:*:*:*

History

20 Jul 2026, 12:19

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2026:41921 - () https://access.redhat.com/errata/RHSA-2026:41921 -

20 Jul 2026, 10:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:41921 -

08 Jul 2026, 13:16

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2026:34764 - () https://access.redhat.com/errata/RHSA-2026:34764 -
References () https://access.redhat.com/errata/RHSA-2026:34788 - () https://access.redhat.com/errata/RHSA-2026:34788 -

07 Jul 2026, 19:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:34788 -

07 Jul 2026, 15:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:34764 -

07 Jul 2026, 12:16

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2026:36004 - () https://access.redhat.com/errata/RHSA-2026:36004 -
References () https://access.redhat.com/errata/RHSA-2026:36005 - () https://access.redhat.com/errata/RHSA-2026:36005 -
References () https://access.redhat.com/errata/RHSA-2026:36006 - () https://access.redhat.com/errata/RHSA-2026:36006 -

06 Jul 2026, 20:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36005 -

06 Jul 2026, 18:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36004 -
  • () https://access.redhat.com/errata/RHSA-2026:36006 -

02 Jul 2026, 12:17

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2026:34372 - () https://access.redhat.com/errata/RHSA-2026:34372 -

01 Jul 2026, 20:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:34372 -

01 Jul 2026, 13:17

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2026:29794 - () https://access.redhat.com/errata/RHSA-2026:29794 -

30 Jun 2026, 17:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:29794 -

30 Jun 2026, 03:19

Type Values Removed Values Added
References
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json -
References () https://access.redhat.com/errata/RHSA-2026:13274 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2026:13274 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2026:20611 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2026:20611 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2026:20612 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2026:20612 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2026:20613 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2026:20613 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2026:26319 - () https://access.redhat.com/errata/RHSA-2026:26319 -
References () https://access.redhat.com/errata/RHSA-2026:26409 - () https://access.redhat.com/errata/RHSA-2026:26409 -
References () https://access.redhat.com/errata/RHSA-2026:29197 - () https://access.redhat.com/errata/RHSA-2026:29197 -
References () https://access.redhat.com/errata/RHSA-2026:30004 - () https://access.redhat.com/errata/RHSA-2026:30004 -
References () https://access.redhat.com/errata/RHSA-2026:30849 - () https://access.redhat.com/errata/RHSA-2026:30849 -
References () https://access.redhat.com/errata/RHSA-2026:30850 - () https://access.redhat.com/errata/RHSA-2026:30850 -
References () https://access.redhat.com/errata/RHSA-2026:32962 - () https://access.redhat.com/errata/RHSA-2026:32962 -
References () https://access.redhat.com/errata/RHSA-2026:33125 - () https://access.redhat.com/errata/RHSA-2026:33125 -
References () https://access.redhat.com/security/cve/CVE-2026-42009 - Third Party Advisory () https://access.redhat.com/security/cve/CVE-2026-42009 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2467279 - Issue Tracking, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2467279 - Issue Tracking, Third Party Advisory

29 Jun 2026, 22:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:33125 -

29 Jun 2026, 12:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:32962 -

29 Jun 2026, 09:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:30849 -
  • () https://access.redhat.com/errata/RHSA-2026:30850 -

26 Jun 2026, 08:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:30004 -

25 Jun 2026, 20:17

Type Values Removed Values Added
References
  • () https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2 -

24 Jun 2026, 17:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:29197 -

17 Jun 2026, 13:20

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:26319 -
  • () https://access.redhat.com/errata/RHSA-2026:26409 -

08 Jun 2026, 17:16

Type Values Removed Values Added
CPE cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_update_services_for_sap_solutions:9.8:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:9.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_els:9.8:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:8.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_els:9.8:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:9.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:10.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux:9.8:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:8.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:x64:*
cpe:2.3:a:gnu:gnutls:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_els:8.10:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_eus:9.8:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:10.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_els:8.10:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_eus:9.8:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.8:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
First Time Redhat enterprise Linux
Gnu gnutls
Redhat enterprise Linux For Ibm Z Systems Els
Redhat enterprise Linux For Power Little Endian Els
Redhat enterprise Linux For Eus
Redhat enterprise Linux For Update Services For Sap Solutions
Redhat openshift Container Platform
Redhat hardened Images
Redhat enterprise Linux For Els
Redhat enterprise Linux For Power Little Endian
Redhat enterprise Linux For Ibm Z Systems Eus
Redhat enterprise Linux For Ibm Z Systems
Gnu
Redhat
Redhat enterprise Linux For Power Little Endian Eus
Redhat enterprise Linux Server For Power Little Endian Update Services For Sap Solutions
References () https://access.redhat.com/errata/RHSA-2026:13274 - () https://access.redhat.com/errata/RHSA-2026:13274 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2026:20611 - () https://access.redhat.com/errata/RHSA-2026:20611 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2026:20612 - () https://access.redhat.com/errata/RHSA-2026:20612 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2026:20613 - () https://access.redhat.com/errata/RHSA-2026:20613 - Third Party Advisory
References () https://access.redhat.com/security/cve/CVE-2026-42009 - () https://access.redhat.com/security/cve/CVE-2026-42009 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2467279 - () https://bugzilla.redhat.com/show_bug.cgi?id=2467279 - Issue Tracking, Third Party Advisory

02 Jun 2026, 16:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:20612 -

01 Jun 2026, 21:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:20613 -

27 May 2026, 04:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:20611 -

24 May 2026, 02:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:13274 -

18 May 2026, 13:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-05-18 13:16

Updated : 2026-07-20 12:19


NVD link : CVE-2026-42009

Mitre link : CVE-2026-42009

CVE.ORG link : CVE-2026-42009


JSON object : View

Products Affected

redhat

  • enterprise_linux_for_ibm_z_systems_eus
  • openshift_container_platform
  • enterprise_linux_for_power_little_endian_els
  • enterprise_linux_for_power_little_endian_eus
  • enterprise_linux_for_els
  • enterprise_linux_for_ibm_z_systems
  • hardened_images
  • enterprise_linux_for_power_little_endian
  • enterprise_linux_for_eus
  • enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
  • enterprise_linux_for_ibm_z_systems_els
  • enterprise_linux_for_update_services_for_sap_solutions
  • enterprise_linux

gnu

  • gnutls
CWE
CWE-475

Undefined Behavior for Input to API