{"id":"CLSA-2026-1784018375","summary":"Fix CVE(s): CVE-2026-33846, CVE-2026-42009","details":"   * SECURITY UPDATE: heap buffer overflow in DTLS handshake reassembly\n     - debian/patches/CVE-2026-33846.patch: add length-consistency and array\n       bounds checks in merge_handshake_packet in lib/gnutls_buffers.c to reject\n       DTLS fragments with mismatching or oversized claimed length\n     - CVE-2026-33846\n   * SECURITY UPDATE: denial of service via non-conforming qsort comparator\n     - debian/patches/CVE-2026-42009.patch: return 0 for equal sequence numbers\n       in handshake_compare in lib/gnutls_buffers.c so DTLS packet ordering\n       follows the qsort strict-weak-ordering contract\n     - CVE-2026-42009","modified":"2026-10-26T09:31:47.113035082Z","published":"2026-08-11T22:07:33Z","upstream":["CVE-2026-33846","CVE-2026-42009"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1784018375.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33846"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42009"}],"affected":[{"package":{"name":"gnutls-bin","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/gnutls-bin?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-4ubuntu1.9+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018375.json"}},{"package":{"name":"gnutls-doc","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/gnutls-doc?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-4ubuntu1.9+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018375.json"}},{"package":{"name":"guile-gnutls","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/guile-gnutls?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-4ubuntu1.9+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018375.json"}},{"package":{"name":"libgnutls-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libgnutls-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-4ubuntu1.9+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018375.json"}},{"package":{"name":"libgnutls-openssl27","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libgnutls-openssl27?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-4ubuntu1.9+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018375.json"}},{"package":{"name":"libgnutls28-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libgnutls28-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-4ubuntu1.9+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018375.json"}},{"package":{"name":"libgnutls30","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libgnutls30?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-4ubuntu1.9+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018375.json"}},{"package":{"name":"libgnutlsxx28","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libgnutlsxx28?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-4ubuntu1.9+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018375.json"}}],"schema_version":"1.9.0"}