A heap buffer overflow vulnerability in the DTLS handshake fragment reassembly logic of GnuTLS allows unauthenticated remote attackers to trigger denial of service or memory corruption.

This vulnerability is an improper handling of length parameter inconsistency, categorized under CWE-130, occurring within the merge_handshake_packet function where incoming handshake fragments are processed without validating that the message length remains consistent. The flaw is remotely exploitable without authentication via the DTLS handshake path.

A successful exploitation of this vulnerability can lead to application crashes or potential memory corruption, resulting in service disruption for critical network applications relying on GnuTLS. With a CVSS score of 7.5, the high severity classification reflects the capability of unauthenticated remote actors to induce a denial of service, threatening system availability and operational integrity.

Immediate Action: Apply the vendor security updates immediately, upgrading GnuTLS packages to the fixed versions corresponding to your specific Red Hat Enterprise Linux release, such as version 3.8.10-4.el10_2 or later for RHEL 10.

Proactive Monitoring: Monitor network traffic for anomalous DTLS handshake patterns and review system logs for unexpected application crashes or service restarts related to GnuTLS.

Compensating Controls: Implement network intrusion detection and prevention systems to inspect DTLS traffic and drop malformed handshake packets if immediate patching is not feasible.

Public Exploit Available: No

Given the high severity rating and the potential for remote denial of service, administrators must prioritize the deployment of available vendor patches. Immediate remediation is essential to eliminate exposure to potential heap corruption and ensure continuous system availability.