Description
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.
Published: 2026-05-26
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4595-1 gnutls28 security update
Debian DSA Debian DSA DSA-6281-1 gnutls28 security update
Ubuntu USN Ubuntu USN USN-8284-1 GnuTLS vulnerabilities
Ubuntu USN Ubuntu USN USN-8502-1 GnuTLS vulnerabilities
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:13274 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20611 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20612 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20613 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26319 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26409 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:29197 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:30004 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:30849 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:30850 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:32962 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:33125 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:40762 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:41921 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:56853 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:57483 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:58981 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:59831 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:60019 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:67837 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:72502 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:74674 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:77320 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82304 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82322 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82347 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82354 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82372 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82857 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82888 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2026-5260 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2467450 cve-icon cve-icon
https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10 cve-icon cve-icon
History

Thu, 15 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.13::el9
References

Wed, 14 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
References

Wed, 14 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:cert_manager:1.17::el9
cpe:/a:redhat:cert_manager:1.18::el9
References

Fri, 02 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Ai
CPEs cpe:/a:redhat:openshift_ai:3.4::el9
Vendors & Products Redhat openshift Ai
References

Tue, 29 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat cert Manager
CPEs cpe:/a:redhat:cert_manager:1.20::el9
Vendors & Products Redhat cert Manager
References

Thu, 24 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.14::el9
References

Thu, 03 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el9
References

Thu, 03 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.12::el8
References

Mon, 31 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.16::el9
References

Wed, 26 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.18::el9
References

Tue, 25 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
References

Wed, 22 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.19::el9
References

Mon, 20 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/o:redhat:rhel_e4s:9.2::baseos
References

Wed, 15 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
References

Tue, 30 Jun 2026 03:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
cpe:/o:redhat:rhel_aus:8.4::baseos
cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
References

Mon, 29 Jun 2026 12:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.4::appstream
cpe:/o:redhat:rhel_e4s:9.4::baseos
References

Mon, 29 Jun 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Eus Long Life
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/o:redhat:rhel_e4s:8.8::baseos
cpe:/o:redhat:rhel_eus_long_life:8.6::baseos
cpe:/o:redhat:rhel_tus:8.8::baseos
Vendors & Products Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Eus Long Life
Redhat rhel Tus
References

Fri, 26 Jun 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/o:redhat:rhel_eus:9.6::baseos
Vendors & Products Redhat rhel Eus
References

Thu, 25 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-126
References

Wed, 24 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat discovery
CPEs cpe:/a:redhat:discovery:2::el9
Vendors & Products Redhat discovery
References

Tue, 16 Jun 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhui
CPEs cpe:/a:redhat:rhui:5::el9
cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
Redhat rhui
References

Tue, 02 Jun 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
References

Mon, 01 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References

Wed, 27 May 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 27 May 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Gnu
Gnu gnutls
Redhat hardened Images
Redhat openshift Container Platform
Vendors & Products Gnu
Gnu gnutls
Redhat hardened Images
Redhat openshift Container Platform

Wed, 27 May 2026 03:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/o:redhat:enterprise_linux:8::baseos
References

Tue, 26 May 2026 21:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.
Title Gnutls: gnutls: information disclosure via heap overread in rsa key exchange
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
Weaknesses CWE-1284
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}

Subscriptions

Gnu Gnutls
Redhat Cert Manager Discovery Enterprise Linux Enterprise Linux Eus Hardened Images Hummingbird Openshift Openshift Ai Openshift Container Platform Rhel Aus Rhel E4s Rhel Eus Rhel Eus Long Life Rhel Tus Rhui
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-15T16:58:46.734Z

Reserved: 2026-03-31T16:25:06.721Z

Link: CVE-2026-5260

cve-icon Vulnrichment

Updated: 2026-05-27T13:37:05.687Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-26T22:16:44.170

Modified: 2026-10-15T17:17:25.673

Link: CVE-2026-5260

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T23:45:16Z

Weaknesses