CVE-2026-42009

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-475

Affected software

No affected versions have been published.

Timeline

Published: May 18, 2026
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-42017.3A weakness has been identified in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability affects the function U CVE-2026-420109.8A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing CVE-2026-420117.4A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate CVE-2026-420127.1A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains U CVE-2026-420138.2A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to CVE-2026-420146.6A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-CVE-2026-420155.3A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker CVE-2026-420168.8JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the to CVE-2026-420178.8An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific con CVE-2026-420187.5JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially CVE-2026-420199.1Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-G CVE-2026-42024.3The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records whe