CVE-2026-42009
Publication date 30 April 2026
Last updated 22 May 2026
Ubuntu priority
Description
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| gnutls28 | 26.04 LTS resolute |
Fixed 3.8.12-2ubuntu1.1
|
| 25.10 questing |
Fixed 3.8.9-3ubuntu2.2
|
|
| 24.04 LTS noble |
Fixed 3.8.3-1.1ubuntu3.6
|
|
| 22.04 LTS jammy |
Fixed 3.7.3-4ubuntu1.9
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.5 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-8284-1
- GnuTLS vulnerabilities
- 20 May 2026