Echo: gnutls28: security update to 3.8.9-3+e8

high Tenable Cloud Security Plugin ID 460278

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The
issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based
solely on handshake type, without validating that the message_length field remains consistent across all
fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with
conflicting message_length values, causing the implementation to allocate a buffer based on a smaller
initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because
the merge operation does not enforce proper bounds checking against the allocated buffer size, this
results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without
authentication via the DTLS handshake path and can lead to application crashes or potential memory
corruption. (CVE-2026-33846)

Solution

Update the gnutls28 library and its related packages to version 3.8.9-3+e8 or later.

Plugin Details

Severity: High

ID: 460278

Version: Revision 1.1

Type: Local

Family: Echo Local Security Checks

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.74

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-33846

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/1/2026

Vulnerability Publication Date: 4/30/2026

Reference Information

CVE: CVE-2026-33846

IAVA: 2026-A-0405

Detections

Analytics