The vulnerability CVE-2026-5419 affects the GnuTLS library in Red Hat Enterprise Linux 10. It involves a timing side-channel caused by a non-constant-time PKCS#7 padding check during decryption. This timing discrepancy can potentially leak sensitive information about padding bytes to a remote attacker, constituting an information disclosure vulnerability. The CVSS v3.1 base score is 3.7 (low severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact. Red Hat has issued a security advisory (RHSA-2026:20613) that includes an updated GnuTLS package fixing this and several other vulnerabilities. The advisory covers multiple architectures and update support levels of Red Hat Enterprise Linux 10. The vendor recommends applying the update after ensuring all previous errata are applied.

The impact of CVE-2026-5419 is limited to information disclosure through a timing side-channel in the PKCS#7 padding check of GnuTLS. There is no impact on integrity or availability. The vulnerability requires network access but has high attack complexity and no privileges or user interaction needed. No known exploits are reported in the wild. The overall severity is low, and the vendor rates the update containing the fix as having moderate security impact due to multiple vulnerabilities addressed together.

Red Hat has released an updated GnuTLS package for Red Hat Enterprise Linux 10 that fixes CVE-2026-5419 along with other vulnerabilities. Users should apply this official security update as detailed in Red Hat advisory RHSA-2026:20613. Before applying the update, ensure all previously released errata relevant to the system are installed. No additional mitigations are specified or required beyond applying the vendor-provided patch.