A heap buffer overflow exists in GnuTLS’ DTLS handshake fragment reassembly logic. The vulnerability resides in merge_handshake_packet() where incoming handshake fragments are merged only by type, without validating that all fragments of a logical message agree on the message_length field. An attacker can send crafted DTLS fragments that contain conflicting message_length values, causing the implementation to allocate a buffer based on the length of the first fragment and then write data from subsequent larger fragments beyond that buffer. The lack of bounds checking during the merge operation allows an out‑of‑bounds write on the heap, which can crash the application or lead to general memory corruption. Because no authentication is required, remote attackers can trigger this by initiating a DTLS handshake with the victim.

Red Hat Enterprise Linux 10, 6, 7, 8, and 9, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 contain the affected GnuTLS implementation. The vulnerability applies to all components on those platforms that use GnuTLS for DTLS communication. The affected products are identified by the vendor name and product line; version details are not provided in the current data.

The CVSS score of 7.5 indicates high severity, while the EPSS score is unavailable, suggesting no current known exploitation data. The vulnerability is listed as not being in the CISA KEV catalog, but it can still be exploited remotely without authentication. Attackers can trigger the issue simply by initiating a DTLS connection with crafted fragments, either from external or internal traffic. The lack of authentication and the remote nature of the attack vector make this a high‑risk vulnerability for any exposed DTLS services.