Executive brief
A security vulnerability has been identified in GnuTLS, a widely used library that enables secure communications for applications and services. When a server uses specific hardware-backed security tokens (PKCS#11) for encryption, a remote attacker can send a specially crafted message to trigger a memory error. This could allow the attacker to access sensitive information from the server's memory or cause the service to crash, potentially disrupting business operations.
Technical details
A heap overread vulnerability exists in libgnutls during the RSA key exchange process. The issue occurs when a remote attacker sends an abnormally short premaster secret to a server configured with an RSA key backed by a PKCS#11 token. This improper validation of input quantity (CWE-1284) leads to a short memory overread on the heap. An attacker can exploit this over the network without authentication to disclose sensitive memory contents or cause a denial-of-service (DoS) condition. The vulnerability specifically impacts environments utilizing PKCS#11 hardware security modules or tokens for key management.
Affected products
- GnuTLS GnuTLS (libgnutls)
Timeline
- 2026-05-06: other: Initial report in Red Hat Bugzilla
- 2026-05-26: disclosed: CVE published to NVD dataset