new file mode 100644
@@ -0,0 +1,66 @@
+From f83c50305b4186075aeea26c7d8d64fdad95f381 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Fri, 17 Apr 2026 18:21:36 +0200
+Subject: [PATCH] buffers: add more checks to DTLS reassembly
+
+Previously, gnutls didn't check that DTLS fragments claimed
+a consistent message_length value.
+Additionally, a crucial array size check was missing,
+enabling an attacker to cause a heap overwrite.
+The updated version rejects fragments with mismatching length
+and adds a missing boundary check.
+
+Reported-by: Haruto Kimura (Stella)
+Reported-by: Oscar Reparaz
+Reported-by: Zou Dikai
+Fixes: #1816
+Fixes: #1838
+Fixes: #1839
+Fixes: CVE-2026-33846
+Fixes: GNUTLS-SA-2026-04-29-1
+CVSS: 7.4 High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
+CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+
+CVE: CVE-2026-33846
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/65ab33fa54e34fba69d793735b7df3d383d1ff78]
+Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
+---
+ lib/buffers.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/lib/buffers.c b/lib/buffers.c
+index 672380b05..2934fd366 100644
+--- a/lib/buffers.c
++++ b/lib/buffers.c
+@@ -1009,6 +1009,27 @@ static int merge_handshake_packet(gnutls_session_t session,
+ &session->internals.handshake_recv_buffer[pos], hsk);
+
+ } else {
++ if (hsk->length !=
++ session->internals.handshake_recv_buffer[pos].length) {
++ /* inconsistent across fragments */
++ _gnutls_handshake_buffer_clear(hsk);
++ return gnutls_assert_val(
++ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
++ }
++ /* start_offset + data.length <= hsk->length <= max_length */
++ if (hsk->length < hsk->start_offset + hsk->data.length) {
++ /* impossible claims, overflow requested */
++ _gnutls_handshake_buffer_clear(hsk);
++ return gnutls_assert_val(
++ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
++ }
++ if (hsk->length >
++ session->internals.handshake_recv_buffer[pos].data.max_length) {
++ /* we don't have this much allocated, overflow guard */
++ _gnutls_handshake_buffer_clear(hsk);
++ return gnutls_assert_val(
++ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
++ }
+ if (hsk->start_offset <
+ session->internals.handshake_recv_buffer[pos]
+ .start_offset &&
+--
+2.47.3
+
@@ -45,6 +45,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://CVE-2025-14831-9.patch \
file://CVE-2026-42009_p1.patch \
file://CVE-2026-42009_p2.patch \
+ file://CVE-2026-33846.patch \
"
SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"
Backport patch [1] referenced in [2]. The difference in upstream and the backport is skipping of intermediate patch [3] which essentially just aliases `session->internals.handshake_recv_buffer -> recv_buf'. NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33846 [1] https://gitlab.com/gnutls/gnutls/-/commit/65ab33fa54e34fba69d793735b7df3d383d1ff78 [2] https://security-tracker.debian.org/tracker/CVE-2026-33846 [3] https://gitlab.com/gnutls/gnutls/-/commit/9deffca528c23bbb218f5ec3bd4bb1bf4cbd1fc0 Signed-off-by: Roland Kovacs <roland.kovacs@est.tech> --- v1: https://lists.openembedded.org/g/openembedded-core/message/243866 v1 -> v2: - Fix patchtest subject line format issue. .../gnutls/gnutls/CVE-2026-33846.patch | 66 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-33846.patch