CVE-2026-5419
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A flaw was found in gnutls where the PKCS#7 padding check during decryption was not constant-time. This timing side-channel could allow a remote attacker to leak sensitive information about padding bytes. This is a form of information disclosure.
Risk Assessment
An attacker could exploit timing differences to read sensitive data, potentially leading to information leakage or further cryptographic attacks.
Recommendation
Update the gnutls library to a version that fixes the timing side-channel.
Original NVD description (English source)
A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.