CVE-2026-5260 Gnutls: gnutls: information disclosure via heap overread in rsa key exchange
A remote attacker can trigger a heap overread in GnuTLS during RSA key exchange with PKCS#11 tokens, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5260?
CVE-2026-5260 is a high-severity vulnerability in Cert Manager support for Red Hat OpenShift release 1.17, published on 26 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.
Weakness: CWE-126
Which versions are affected by CVE-2026-5260?
How do I fix CVE-2026-5260?
Apply the vendor's patch.
Is CVE-2026-5260 being exploited?
There is no known exploitation of CVE-2026-5260 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-5260, AZL-89184, BELL-CVE-2026-5260, DEBIAN-CVE-2026-5260, ECHO-f2e1-886c-4323, GHSA-6hj5-4cv5-f46x.