A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | affected | — |
| Red Hat | Red Hat Enterprise Linux 6 | unknown | — |
| Red Hat | Red Hat Enterprise Linux 7 | affected | — |
| Red Hat | Red Hat Enterprise Linux 8 | affected | — |
| Red Hat | Red Hat Enterprise Linux 9 | affected | — |
| Red Hat | Red Hat Hardened Images | affected | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — |
No data.
No data.
No data.
Project Subscriptions
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-4595-1 | gnutls28 security update |
 Debian DSA |
DSA-6281-1 | gnutls28 security update |
 Ubuntu USN |
USN-8284-1 | GnuTLS vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 26 May 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure. | |
| Title | Gnutls: gnutls: information disclosure via heap overread in rsa key exchange | |
| First Time appeared |
Redhat
Redhat enterprise Linux Redhat hummingbird Redhat openshift |
|
| Weaknesses | CWE-1284 | |
| CPEs | cpe:/a:redhat:hummingbird:1 cpe:/a:redhat:openshift:4 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat enterprise Linux Redhat hummingbird Redhat openshift |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-05-26T21:29:20.743Z
Reserved: 2026-03-31T16:25:06.721Z
Link: CVE-2026-5260
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses