Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal (gnutls)

CVE-2026-5419
LOW 3.7

At a glance

Source
NVD
EPSS
EPSS 0.54 % · percentile 46 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Awaiting Analysis

Search on…

Description

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Weaknesses (CWE)

  • CWE-208 — Observable Timing Discrepancy

References

Scores

VersionScoreVectorScored by
CVSS 3.1LOW 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:Nredhat
CVSS 3.1LOW 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NNVD · secalert@redhat.com (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
gnutlsaffected 0
Red Hat · Red Hat Enterprise Linux 10unaffected 0:3.8.10-4.el10_2 < *
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Supportunaffected 0:3.8.9-9.el10_0.19 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:3.8.10-4.el9_8 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:3.8.10-4.el9_8 < *
Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutionsunaffected 0:3.8.3-4.el9_4.6 < *
Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Supportunaffected 0:3.8.3-6.el9_6.4 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.17unaffected 1791371080 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.17unaffected 1791371069 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.17unaffected 1791788287 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.17unaffected 1791970484 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459707 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459711 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459759 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1789029076 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791966259 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.20unaffected 1790598593 < *
Red Hat · Red Hat Discovery 2unaffected 1782159791 < *
Red Hat · Red Hat Discovery 2unaffected 1782166952 < *
Red Hat · Red Hat Hardened Imagesunaffected 3.8.13-1.hum1 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD