CVE-2026-5260 is a memory corruption vulnerability in libgnutls where a remote attacker can trigger a short heap overread by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token. This flaw can lead to information disclosure. The vulnerability has a CVSS 3.1 base score indicating network attack vector, low attack complexity, no privileges or user interaction required, with impact on confidentiality and availability. Red Hat has issued an important security advisory with patches for gnutls in Red Hat Enterprise Linux 9.2 that address this and multiple other vulnerabilities. The advisory includes updated packages to remediate the issue.

The vulnerability allows a remote attacker to cause a heap overread during the RSA key exchange process, potentially leading to disclosure of sensitive information from server memory. The CVSS vector indicates that exploitation requires no privileges or user interaction and can be performed remotely over the network. The impact includes partial confidentiality loss and denial of service due to memory corruption.

Red Hat has released security updates for gnutls in Red Hat Enterprise Linux 9.2 that fix this vulnerability along with several others. Applying these official patches will remediate the issue. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to update affected packages. No additional mitigation steps are indicated beyond applying the vendor-provided updates.