A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. (CVE-2026-5419)

The vulnerability (CVE-2026-5419) in gnutls involves the PKCS#7 padding check performed during decryption not being constant-time. This timing side-channel could allow a remote attacker to infer sensitive information about the padding bytes by measuring observable timing differences. The issue is a form of information disclosure and has a CVSS 3.1 base score of 3.7 (low severity). Red Hat advisories confirm that fixed versions are available in gnutls 3.8.13 and later.

The impact is limited to potential information disclosure via timing side-channels during decryption operations using PKCS#7 padding in affected gnutls versions. There is no indication of privilege escalation, denial of service, or code execution. The CVSS score and vendor advisory classify this as a low severity issue.

Red Hat has published security advisories with updated gnutls packages that fix this vulnerability. Users should apply the gnutls update to version 3.8.13 or later as provided in the Red Hat errata. No additional mitigation steps are indicated beyond applying the official patch.