CVE-2026-5419: Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-01 · updated 2026-10-14
Weakness: CWE-208

Description

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Affected products

Red Hat Cert Manager support for Red Hat OpenShift release 1.17: all versions — fixed in 1791371069, 1791371080, 1791788287, 1791970484
Red Hat Cert Manager support for Red Hat OpenShift release 1.18: all versions — fixed in 1789029076, 1791459707, 1791459711, 1791459759, 1791966259
Red Hat Cert Manager support for Red Hat OpenShift release 1.20: all versions — fixed in 1790598593
Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Discovery 2: all versions — fixed in 1782159791, 1782166952
Red Hat Enterprise Linux 10: all versions — fixed in 0:3.8.10-4.el10_2
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:3.8.9-9.el10_0.19
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions — fixed in 0:3.8.10-4.el9_8
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: all versions — fixed in 0:3.8.3-4.el9_4.6
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:3.8.3-6.el9_6.4
Red Hat Hardened Images: all versions — fixed in 3.8.13-1.hum1
Red Hat OpenShift AI 3.4: all versions — fixed in 1790703542
Red Hat Update Infrastructure 5: all versions — fixed in 1781525671, 1781525684, 1781525693, 1781525739, 1787135742, 1787241211

How to fix

Upgrade to a fixed version: Red Hat Cert Manager support for Red Hat OpenShift release 1.17 1791371069, 1791371080, 1791788287, 1791970484; Red Hat Cert Manager support for Red Hat OpenShift release 1.18 1789029076, 1791459707, 1791459711, 1791459759; Red Hat Cert Manager support for Red Hat OpenShift release 1.20 1790598593; Red Hat Discovery 2 1782159791, 1782166952; Red Hat Enterprise Linux 10 0:3.8.10-4.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.8.9-9.el10_0.19; Red Hat Enterprise Linux 9 0:3.8.10-4.el9_8; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:3.8.3-4.el9_4.6; Red Hat Enterprise Linux 9.6 Extended Update Support 0:3.8.3-6.el9_6.4; Red Hat Hardened Images 3.8.13-1.hum1; Red Hat OpenShift AI 3.4 1790703542; Red Hat Update Infrastructure 5 1781525671, 1781525684, 1781525693, 1781525739. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-5419 or the next vulnerability affects your stack