CVE-2026-5419: Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal
A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.
Other sources
Guntls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal
— Microsoft
libgnutls: Fix timing side-channel in PKCS#7 padding removal The PKCS#7 padding check performed during decryption was not constant-time, potentially leaking information about the padding bytes through timing differences. Rewritten to remove padding in a branch-free manner.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.7.1-5+deb11u5Fixed in 3.7.1-5+deb11u9Fixed in 3.7.9-2+deb12u7Fixed in 3.8.9-3+deb13u4Fixed in 3.8.13-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.13-1 - Upgrade
Upgrade
gnutlsto a version that resolves this vulnerability.Patch libgnutls: Fix timing side-channel in PKCS#7 padding removal - Compensating control
If immediate upgrade is not possible, reduce exposure to remote attackers that can observe timing differences (e.g., limit/mitigate network paths that allow attackers to trigger PKCS#7 decryption and measure response timing).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5419?
CVE-2026-5419 has a severity rating of low, with a score of 3.7.
How does CVE-2026-5419 impact GnuTLS?
CVE-2026-5419 allows a remote attacker to potentially leak sensitive information via a timing side-channel during padding removal in PKCS#7 operations.
What is the risk associated with CVE-2026-5419?
The risk level for CVE-2026-5419 is rated at 21, indicating a low risk of exploitation.
How can I mitigate CVE-2026-5419?
Mitigation for CVE-2026-5419 can be achieved by updating GnuTLS to the latest version that addresses this timing side-channel issue.
Is CVE-2026-5419 exploitable remotely?
Yes, CVE-2026-5419 is considered to be exploitable remotely due to the nature of the timing side-channel vulnerability.