CVE-2026-33846: vLLM — HIGH

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
85.4K 129 dependents Pushed yesterday 22% patched ~51d to patch Full package profile →
discovery/discovery-server-rhel9	—	—	No patch
discovery/discovery-ui-rhel9	—	—	No patch
gnutls	—	—	No patch
gnutls-main	—	—	No patch
libtasn1	—	—	No patch
rhaiis/model-opt-cuda-rhel9	—	—	No patch
rhcos	—	—	No patch
rhui5/cds-rhel9	—	—	No patch
rhui5/haproxy-rhel9	—	—	No patch
rhui5/installer-rhel9	—	—	No patch
rhui5/rhua-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-33846?

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Is CVE-2026-33846 actively exploited?

No confirmed active exploitation of CVE-2026-33846 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-33846?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2026-33846?

CVE-2026-33846 has a CVSS v3.1 base score of 7.5 (HIGH).

What are the technical details?

Original Advisory

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Weaknesses (CWE)

CWE-130 Improper Handling of Length Parameter Inconsistency

CWE-130 — Improper Handling of Length Parameter Inconsistency: The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

[Implementation] When processing structured incoming data containing a size field followed by raw data, ensure that you identify and resolve any inconsistencies between the size field and the actual size of the data.
[Implementation] Do not let the user control the size of the buffer.

Source: MITRE CWE corpus.