CVE-2026-33845: GnuTLS: DTLS integer underflow enables OOB read/DoS

HIGH

Published April 30, 2026

CISO Take

A specially crafted DTLS handshake fragment with zero length and a non-zero offset triggers an integer underflow in GnuTLS's fragment reassembly logic, producing an out-of-bounds read that can crash the TLS stack or leak adjacent memory. Because GnuTLS underpins TLS/DTLS for many system libraries and for Red Hat's AI Inference Server images (vLLM ROCm and CUDA-optimized model-serving containers), a single unauthenticated network packet can degrade or crash any exposed inference endpoint that terminates DTLS — no privileges, no user interaction, and only low attack complexity are required (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). With 129 downstream dependents, no CISA KEV listing, no published EPSS score, and no public exploit or Nuclei template observed yet, mass exploitation isn't imminent, but the trivial trigger condition means opportunistic scanning could emerge quickly once technical detail circulates further. Red Hat has already issued ten RHSA advisories covering GnuTLS across RHEL9 base images, RHAIIS model-serving containers, RHUI, and RHCOS — patch these immediately, especially any internet-facing AI Inference Server deployment, and monitor for anomalous DTLS traffic or crash-loops on TLS-terminating inference gateways in the interim.

Sources:NVDCISA KEVaccess.redhat.comATLAS

What is the risk?

High severity (CVSS 7.5) driven by unauthenticated, network-reachable, low-complexity exploitation (AV:N/AC:L/PR:N/UI:N) with no dependency on user interaction. The CVSS vector scores impact as availability-only (A:H), but the vendor description also flags potential information disclosure via the out-of-bounds read, so both DoS and memory-leak outcomes should be treated as plausible. Exploitation likelihood is currently moderate-to-low in practice: EPSS is not yet scored, the CVE is not in CISA KEV, and no public exploit code or Nuclei template exists. However, exposure is broad — 129 downstream dependents and a package risk score of 61/100 — and the flaw sits in a widely embedded crypto library rather than a niche component, so the population of reachable, unpatched instances is likely large until Red Hat's ten RHSA advisories are applied.

How does the attack unfold?

Entry Point

Attacker sends a malformed DTLS handshake fragment (zero length, non-zero offset) to an internet-facing GnuTLS-based service such as an AI inference gateway.

AML.T0049

Trigger Integer Underflow

GnuTLS's fragment reassembly logic underflows during offset/length arithmetic, corrupting reassembly buffer bounds (CWE-191).

Out-of-Bounds Read

The underflow causes GnuTLS to read past the allocated buffer, potentially exposing adjacent memory contents.

Impact: DoS / Information Disclosure

The service crashes, taking the AI inference endpoint offline, or leaks memory that may contain session or request data.

AML.T0029

Entry Point

Attacker sends a malformed DTLS handshake fragment (zero length, non-zero offset) to an internet-facing GnuTLS-based service such as an AI inference gateway.

AML.T0049

Trigger Integer Underflow

GnuTLS's fragment reassembly logic underflows during offset/length arithmetic, corrupting reassembly buffer bounds (CWE-191).

Out-of-Bounds Read

The underflow causes GnuTLS to read past the allocated buffer, potentially exposing adjacent memory contents.

Impact: DoS / Information Disclosure

The service crashes, taking the AI inference endpoint offline, or leaks memory that may contain session or request data.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
96.0K94 dependentsPushed yesterday27% patched~37d to patchFull package profile →
discovery/discovery-server-rhel9	—	—	No patch
discovery/discovery-ui-rhel9	—	—	No patch
gnutls	—	—	No patch
gnutls-main	—	—	No patch
libtasn1	—	—	No patch
rhaiis/model-opt-cuda-rhel9	—	—	No patch
rhcos	—	—	No patch
rhui5/cds-rhel9	—	—	No patch
rhui5/haproxy-rhel9	—	—	No patch
rhui5/installer-rhel9	—	—	No patch
rhui5/rhua-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

2.1%

chance of exploitation in 30 days

Higher than 81% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

Patch GnuTLS and libtasn1 to the versions fixed in the ten listed RHSA advisories (RHSA-2026:13274, 20611-20613, 26319, 26409, 29197, 30004, 30849, 30850) across RHEL9 hosts, RHAIIS containers, RHUI, and RHCOS nodes. Rebuild and redeploy any custom AI inference container images layered on the affected RHAIIS base images rather than relying on host-level patching alone. Where immediate patching isn't feasible, restrict or disable DTLS at network boundaries (firewall/segment UDP-based TLS traffic) for exposed inference gateways, and monitor for unexpected process crashes or restart loops on TLS/DTLS-terminating services as a detection signal. Confirm remediation via rpm -q gnutls libtasn1 on RHEL hosts and by checking container image digests against Red Hat's patched manifests.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSData LeakageInferenceAPIAML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-Security of AI systems

NIST AI RMF

MEASURE 2.7-AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM10:2025-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-33845?

Is CVE-2026-33845 actively exploited?

No confirmed active exploitation of CVE-2026-33845 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-33845?

Patch GnuTLS and libtasn1 to the versions fixed in the ten listed RHSA advisories (RHSA-2026:13274, 20611-20613, 26319, 26409, 29197, 30004, 30849, 30850) across RHEL9 hosts, RHAIIS containers, RHUI, and RHCOS nodes. Rebuild and redeploy any custom AI inference container images layered on the affected RHAIIS base images rather than relying on host-level patching alone. Where immediate patching isn't feasible, restrict or disable DTLS at network boundaries (firewall/segment UDP-based TLS traffic) for exposed inference gateways, and monitor for unexpected process crashes or restart loops on TLS/DTLS-terminating services as a detection signal. Confirm remediation via `rpm -q gnutls libtasn1` on RHEL hosts and by checking container image digests against Red Hat's patched manifests.

What systems are affected by CVE-2026-33845?

This vulnerability affects the following AI/ML architecture patterns: model serving, inference gateways/API endpoints, containerized AI infrastructure.

What is the CVSS score for CVE-2026-33845?

CVE-2026-33845 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 2.07%.

What is the AI security impact?

Affected AI Architectures

model servinginference gateways/API endpointscontainerized AI infrastructure

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

Exploitation Scenario

An attacker with network access to a DTLS-terminating service in front of an AI inference deployment — for example, a load balancer or gateway fronting a vLLM ROCm/CUDA model-serving container on RHAIIS — sends a crafted DTLS handshake containing a zero-length fragment at a non-zero offset. GnuTLS's reassembly logic underflows during offset/length arithmetic (CWE-191) and reads past the allocated buffer. Depending on memory layout, this either crashes the TLS-handling process, causing a denial of service that takes the inference endpoint offline, or returns adjacent heap contents that could include fragments of session state or in-flight request data, resulting in information disclosure — all without authentication or any user interaction.

Weaknesses (CWE)

CWE-191Integer Underflow (Wrap or Wraparound)

CWE-191 — Integer Underflow (Wrap or Wraparound): The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Source: MITRE CWE corpus.