CVE-2026-5260

A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.

Scoring

Severity
HIGH
CVSS base score
8.2
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
EPSS probability
0.73%
CWE
CWE-1284, CWE-126
Published
2026-05-26
Last modified
2026-09-14

Affected products

Weakness type

Markdown version · Browse all CVEs