CVE-2026-5419

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

This vulnerability is rated with a Low severity impact because exploiting timing side-channels in cryptographic operations over a network requires precise measurement capabilities, extensive request volume, and low network jitter. While applications linking against GnuTLS to process encrypted PKCS#7 payloads are exposed to subtle processing time variances, successful extraction of plaintext padding or message content in typical Red Hat environments remains computationally complex and technically difficult to execute reliably.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.