{"cve":"CVE-2026-42009","nvd":{"published":"2026-05-18T13:16:32.707","modified":"2026-10-26T13:10:00.140","status":"Modified","description":"A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-475"],"references":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319"],"products":["gnu:gnutls","redhat:enterprise_linux","redhat:enterprise_linux_for_els","redhat:enterprise_linux_for_eus","redhat:enterprise_linux_for_ibm_z_systems","redhat:enterprise_linux_for_ibm_z_systems_els","redhat:enterprise_linux_for_ibm_z_systems_eus","redhat:enterprise_linux_for_power_little_endian","redhat:enterprise_linux_for_power_little_endian_els","redhat:enterprise_linux_for_power_little_endian_eus","redhat:enterprise_linux_for_update_services_for_sap_solutions","redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions","redhat:hardened_images","redhat:openshift_container_platform"],"source":"nvd","synced_at":"2026-10-26T13:39:24.642594360+00:00"},"epss":{"cve":"CVE-2026-42009","score":0.01335,"percentile":0.7096,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}