Log in Start free

Vulnerability · Published Jun 1, 2026 · Assigned by redhat

CVE-2026-5419Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal

Low 3.7

In plain English

A low-severity security flaw in gnutls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.5%top 54.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10gnutls3.8.10-4.el10_2ALSA-2026:20613
AlmaLinux:9gnutls3.8.10-4.el9_8ALSA-2026:20612
AlmaLinux:10gnutls-c++3.8.10-4.el10_2ALSA-2026:20613
AlmaLinux:9gnutls-c++3.8.10-4.el9_8ALSA-2026:20612
AlmaLinux:10gnutls-dane3.8.10-4.el10_2ALSA-2026:20613
AlmaLinux:9gnutls-dane3.8.10-4.el9_8ALSA-2026:20612
AlmaLinux:10gnutls-devel3.8.10-4.el10_2ALSA-2026:20613
AlmaLinux:9gnutls-devel3.8.10-4.el9_8ALSA-2026:20612
AlmaLinux:10gnutls-fips3.8.10-4.el10_2ALSA-2026:20613
AlmaLinux:10gnutls-utils3.8.10-4.el10_2ALSA-2026:20613
AlmaLinux:9gnutls-utils3.8.10-4.el9_8ALSA-2026:20612
Alpine:v3.20gnutls3.8.13-r0ALPINE-CVE-2026-5419
Alpine:v3.21gnutls3.8.13-r0ALPINE-CVE-2026-5419
Alpine:v3.22gnutls3.8.13-r0ALPINE-CVE-2026-5419
Alpine:v3.23gnutls3.8.13-r0ALPINE-CVE-2026-5419
Alpine:v3.24gnutls3.8.13-r0ALPINE-CVE-2026-5419
Debian:12gnutls283.7.9-2+deb12u7DEBIAN-CVE-2026-5419
Debian:13gnutls283.8.9-3+deb13u4DEBIAN-CVE-2026-5419
Debian:14gnutls283.8.13-1DEBIAN-CVE-2026-5419
Rocky Linux:10gnutls0:3.8.10-4.el10_2RLSA-2026:20613
Rocky Linux:9gnutls0:3.8.10-4.el9_8RLSA-2026:20612
Ubuntu:24.04:LTSgnutls283.8.3-1.1ubuntu3.6UBUNTU-CVE-2026-5419
Ubuntu:25.10gnutls283.8.9-3ubuntu2.2UBUNTU-CVE-2026-5419
Ubuntu:26.04:LTSgnutls283.8.12-2ubuntu1.1UBUNTU-CVE-2026-5419

Affected products (as reported)

VendorProductVersions
gnutls 0
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 see references
Red Hat Red Hat Discovery 2 see references
Red Hat Red Hat Discovery 2 see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references

Weakness: CWE-208 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References