CVE-2026-33845: vLLM DTLS integer underflow enables

CISO Take

A specially crafted DTLS handshake fragment with zero length and a non-zero offset triggers an integer underflow in GnuTLS's fragment reassembly logic, producing an out-of-bounds read that can crash the TLS stack or leak adjacent memory. Because GnuTLS underpins TLS/DTLS for many system libraries and for Red Hat's AI Inference Server images (vLLM ROCm and CUDA-optimized model-serving containers), a single unauthenticated network packet can degrade or crash any exposed inference endpoint that terminates DTLS — no privileges, no user interaction, and only low attack complexity are required (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). With 129 downstream dependents, no CISA KEV listing, no published EPSS score, and no public exploit or Nuclei template observed yet, mass exploitation isn't imminent, but the trivial trigger condition means opportunistic scanning could emerge quickly once technical detail circulates further. Red Hat has already issued ten RHSA advisories covering GnuTLS across RHEL9 base images, RHAIIS model-serving containers, RHUI, and RHCOS — patch these immediately, especially any internet-facing AI Inference Server deployment, and monitor for anomalous DTLS traffic or crash-loops on TLS-terminating inference gateways in the interim.

Sources: NVD CISA KEV access.redhat.com ATLAS

What is the risk?

High severity (CVSS 7.5) driven by unauthenticated, network-reachable, low-complexity exploitation (AV:N/AC:L/PR:N/UI:N) with no dependency on user interaction. The CVSS vector scores impact as availability-only (A:H), but the vendor description also flags potential information disclosure via the out-of-bounds read, so both DoS and memory-leak outcomes should be treated as plausible. Exploitation likelihood is currently moderate-to-low in practice: EPSS is not yet scored, the CVE is not in CISA KEV, and no public exploit code or Nuclei template exists. However, exposure is broad — 129 downstream dependents and a package risk score of 61/100 — and the flaw sits in a widely embedded crypto library rather than a niche component, so the population of reachable, unpatched instances is likely large until Red Hat's ten RHSA advisories are applied.

How does the attack unfold?

Entry Point

Attacker sends a malformed DTLS handshake fragment (zero length, non-zero offset) to an internet-facing GnuTLS-based service such as an AI inference gateway.

AML.T0049

Trigger Integer Underflow

GnuTLS's fragment reassembly logic underflows during offset/length arithmetic, corrupting reassembly buffer bounds (CWE-191).

Out-of-Bounds Read

The underflow causes GnuTLS to read past the allocated buffer, potentially exposing adjacent memory contents.

Impact: DoS / Information Disclosure

The service crashes, taking the AI inference endpoint offline, or leaks memory that may contain session or request data.

AML.T0029

Entry Point

Attacker sends a malformed DTLS handshake fragment (zero length, non-zero offset) to an internet-facing GnuTLS-based service such as an AI inference gateway.

AML.T0049

Trigger Integer Underflow

GnuTLS's fragment reassembly logic underflows during offset/length arithmetic, corrupting reassembly buffer bounds (CWE-191).

Out-of-Bounds Read

The underflow causes GnuTLS to read past the allocated buffer, potentially exposing adjacent memory contents.

Impact: DoS / Information Disclosure

The service crashes, taking the AI inference endpoint offline, or leaks memory that may contain session or request data.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
89.7K 128 dependents Pushed 2d ago 24% patched ~52d to patch Full package profile →
discovery/discovery-server-rhel9	—	—	No patch
discovery/discovery-ui-rhel9	—	—	No patch
gnutls	—	—	No patch
gnutls-main	—	—	No patch
libtasn1	—	—	No patch
rhaiis/model-opt-cuda-rhel9	—	—	No patch
rhcos	—	—	No patch
rhui5/cds-rhel9	—	—	No patch
rhui5/haproxy-rhel9	—	—	No patch
rhui5/installer-rhel9	—	—	No patch
rhui5/rhua-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

Patch GnuTLS and libtasn1 to the versions fixed in the ten listed RHSA advisories (RHSA-2026:13274, 20611-20613, 26319, 26409, 29197, 30004, 30849, 30850) across RHEL9 hosts, RHAIIS containers, RHUI, and RHCOS nodes. Rebuild and redeploy any custom AI inference container images layered on the affected RHAIIS base images rather than relying on host-level patching alone. Where immediate patching isn't feasible, restrict or disable DTLS at network boundaries (firewall/segment UDP-based TLS traffic) for exposed inference gateways, and monitor for unexpected process crashes or restart loops on TLS/DTLS-terminating services as a detection signal. Confirm remediation via rpm -q gnutls libtasn1 on RHEL hosts and by checking container image digests against Red Hat's patched manifests.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Data Leakage Inference API AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Security of AI systems

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-33845?

A specially crafted DTLS handshake fragment with zero length and a non-zero offset triggers an integer underflow in GnuTLS's fragment reassembly logic, producing an out-of-bounds read that can crash the TLS stack or leak adjacent memory. Because GnuTLS underpins TLS/DTLS for many system libraries and for Red Hat's AI Inference Server images (vLLM ROCm and CUDA-optimized model-serving containers), a single unauthenticated network packet can degrade or crash any exposed inference endpoint that terminates DTLS — no privileges, no user interaction, and only low attack complexity are required (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). With 129 downstream dependents, no CISA KEV listing, no published EPSS score, and no public exploit or Nuclei template observed yet, mass exploitation isn't imminent, but the trivial trigger condition means opportunistic scanning could emerge quickly once technical detail circulates further. Red Hat has already issued ten RHSA advisories covering GnuTLS across RHEL9 base images, RHAIIS model-serving containers, RHUI, and RHCOS — patch these immediately, especially any internet-facing AI Inference Server deployment, and monitor for anomalous DTLS traffic or crash-loops on TLS-terminating inference gateways in the interim.

Is CVE-2026-33845 actively exploited?

No confirmed active exploitation of CVE-2026-33845 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-33845?

Patch GnuTLS and libtasn1 to the versions fixed in the ten listed RHSA advisories (RHSA-2026:13274, 20611-20613, 26319, 26409, 29197, 30004, 30849, 30850) across RHEL9 hosts, RHAIIS containers, RHUI, and RHCOS nodes. Rebuild and redeploy any custom AI inference container images layered on the affected RHAIIS base images rather than relying on host-level patching alone. Where immediate patching isn't feasible, restrict or disable DTLS at network boundaries (firewall/segment UDP-based TLS traffic) for exposed inference gateways, and monitor for unexpected process crashes or restart loops on TLS/DTLS-terminating services as a detection signal. Confirm remediation via `rpm -q gnutls libtasn1` on RHEL hosts and by checking container image digests against Red Hat's patched manifests.

What systems are affected by CVE-2026-33845?

This vulnerability affects the following AI/ML architecture patterns: model serving, inference gateways/API endpoints, containerized AI infrastructure.

What is the CVSS score for CVE-2026-33845?

CVE-2026-33845 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.80%.

What is the AI security impact?

Affected AI Architectures

model servinginference gateways/API endpointscontainerized AI infrastructure

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

Exploitation Scenario

An attacker with network access to a DTLS-terminating service in front of an AI inference deployment — for example, a load balancer or gateway fronting a vLLM ROCm/CUDA model-serving container on RHAIIS — sends a crafted DTLS handshake containing a zero-length fragment at a non-zero offset. GnuTLS's reassembly logic underflows during offset/length arithmetic (CWE-191) and reads past the allocated buffer. Depending on memory layout, this either crashes the TLS-handling process, causing a denial of service that takes the inference endpoint offline, or returns adjacent heap contents that could include fragments of session state or in-flight request data, resulting in information disclosure — all without authentication or any user interaction.

Weaknesses (CWE)

CWE-191 Integer Underflow (Wrap or Wraparound)

CWE-191 — Integer Underflow (Wrap or Wraparound): The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Source: MITRE CWE corpus.