The vulnerability CVE-2026-5260 affects libgnutls in Red Hat Enterprise Linux 10. A remote attacker can exploit this by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token. This triggers a short heap overread, a form of memory corruption that may lead to information disclosure. The issue is part of a set of security flaws addressed in updated gnutls packages. Red Hat has published advisories (RHSA-2026:13274 and RHSA-2026:20611) detailing the updates and fixes. The CVSS v3.1 score is 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss and high availability impact.

Successful exploitation of this vulnerability can lead to information disclosure due to a heap buffer over-read. The attacker does not require privileges or user interaction and can exploit the vulnerability remotely over the network. The impact includes potential leakage of sensitive information and denial of service (high impact on availability).

Red Hat has released updated gnutls packages that address this vulnerability. Users of Red Hat Enterprise Linux 10 should apply the security updates as provided in the advisories RHSA-2026:13274 and RHSA-2026:20611. The advisories include updated RPMs for gnutls version 3.8.13-1.hum1 and instructions for applying the updates. Patch status is confirmed as fixed in these updated packages. No alternative mitigations are indicated by the vendor advisory.