CVE-2026-5260CWE-126

CVE-2026-5260

High · published May 27, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
60.7
In the wild
Unconfirmed
What it is

A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00945 · 60.7th percentile
Weakness
CWE-126 · Buffer Over-read
Published
2026-05-27T02:16Z
References (34)
https://access.redhat.com/errata/RHSA-2026:13274 · [email protected]https://access.redhat.com/errata/RHSA-2026:20611 · [email protected]https://access.redhat.com/errata/RHSA-2026:20612 · [email protected]https://access.redhat.com/errata/RHSA-2026:20613 · [email protected]https://access.redhat.com/errata/RHSA-2026:26319 · [email protected]https://access.redhat.com/errata/RHSA-2026:26409 · [email protected]https://access.redhat.com/errata/RHSA-2026:29197 · [email protected]https://access.redhat.com/errata/RHSA-2026:30004 · [email protected]https://access.redhat.com/errata/RHSA-2026:30849 · [email protected]https://access.redhat.com/errata/RHSA-2026:30850 · [email protected]https://access.redhat.com/errata/RHSA-2026:32962 · [email protected]https://access.redhat.com/errata/RHSA-2026:33125 · [email protected]https://access.redhat.com/errata/RHSA-2026:40762 · [email protected]https://access.redhat.com/errata/RHSA-2026:41921 · [email protected]https://access.redhat.com/errata/RHSA-2026:56853 · [email protected]https://access.redhat.com/errata/RHSA-2026:57483 · [email protected]https://access.redhat.com/errata/RHSA-2026:58981 · [email protected]https://access.redhat.com/errata/RHSA-2026:59831 · [email protected]https://access.redhat.com/errata/RHSA-2026:60019 · [email protected]https://access.redhat.com/errata/RHSA-2026:67837 · [email protected]https://access.redhat.com/errata/RHSA-2026:72502 · [email protected]https://access.redhat.com/errata/RHSA-2026:74674 · [email protected]https://access.redhat.com/errata/RHSA-2026:77320 · [email protected]https://access.redhat.com/errata/RHSA-2026:82304 · [email protected]https://access.redhat.com/errata/RHSA-2026:82322 · [email protected]https://access.redhat.com/errata/RHSA-2026:82347 · [email protected]https://access.redhat.com/errata/RHSA-2026:82354 · [email protected]https://access.redhat.com/errata/RHSA-2026:82372 · [email protected]https://access.redhat.com/errata/RHSA-2026:82811 · [email protected]https://access.redhat.com/errata/RHSA-2026:82857 · [email protected]https://access.redhat.com/errata/RHSA-2026:82888 · [email protected]https://access.redhat.com/security/cve/CVE-2026-5260 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2467450 · [email protected]https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10 · [email protected]
EPSS history
Timeline
  • 26 MAY 21:29Z
    Gnutls: gnutls: information disclosure via heap overread in rsa key exchange
    cvelistv5