From bd8f76ce12a57962a62ce2818a6263fb04304c3f Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Mon, 20 Apr 2026 16:32:02 +0200 Subject: [PATCH 6/8] buffers: match DTLS datagrams by sequence number DTLS handshake fragment reassembly previously matched incoming fragments by handshake type only, without checking the sequence number. This allowed fragments from different handshake messages to be merged into the same reassembly buffer. Now sequence number is accounted for during reassembly, ensuring fragments are only merged when they belong to the same handshake message. Reported-by: Zou Dikai Fixes: #1839 Signed-off-by: Alexander Sosedkin Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/092c65d004e2f125f2fea3db84d801ac49a09f78] CVE: CVE-2026-33846 Signed-off-by: Pritam Srichandan Sahoo --- lib/buffers.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/buffers.c b/lib/buffers.c index 5d4d16276..62f140ed3 100644 --- a/lib/buffers.c +++ b/lib/buffers.c @@ -971,7 +971,8 @@ static int merge_handshake_packet(gnutls_session_t session, session->internals.handshake_recv_buffer; for (i = 0; i < session->internals.handshake_recv_buffer_size; i++) { - if (recv_buf[i].htype == hsk->htype) { + if (recv_buf[i].htype == hsk->htype && + recv_buf[i].sequence == hsk->sequence) { exists = 1; pos = i; break; -- 2.53.0