CVE-2026-5419: Observable Timing Discrepancy in Red Hat Red Hat Enterprise Linux 10
A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.
AI Analysis
Technical Summary
The vulnerability CVE-2026-5419 exists in the gnutls library's PKCS#7 padding check implementation, where the padding verification during decryption is not constant-time. This timing side-channel can be observed remotely, potentially leaking sensitive information about the padding bytes. The issue is classified as an information disclosure vulnerability with a CVSS score of 3.7 (low severity). It affects Red Hat Enterprise Linux 10 versions >=10 and <10.2. Red Hat has published security advisories and updates to address this flaw in the gnutls packages.
Potential Impact
The impact of this vulnerability is limited to information disclosure due to a timing side-channel during PKCS#7 padding checks in gnutls. There is no impact on integrity or availability. The CVSS score of 3.7 reflects a low severity risk with network attack vector, high attack complexity, and no privileges or user interaction required.
Mitigation Recommendations
A security update for the gnutls packages that addresses this timing side-channel vulnerability is available from Red Hat. Users of Red Hat Enterprise Linux 10 versions 10 up to but not including 10.2 should apply the updated gnutls packages as provided in the Red Hat security advisories (https://access.redhat.com/errata/RHSA-2026:13274). Patch status is confirmed by the vendor advisory. No additional mitigations are indicated.
CVE-2026-5419: Observable Timing Discrepancy in Red Hat Red Hat Enterprise Linux 10
Description
A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.
CVSS v3.1
Score 3.7low
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-5419 exists in the gnutls library's PKCS#7 padding check implementation, where the padding verification during decryption is not constant-time. This timing side-channel can be observed remotely, potentially leaking sensitive information about the padding bytes. The issue is classified as an information disclosure vulnerability with a CVSS score of 3.7 (low severity). It affects Red Hat Enterprise Linux 10 versions >=10 and <10.2. Red Hat has published security advisories and updates to address this flaw in the gnutls packages.
Potential Impact
The impact of this vulnerability is limited to information disclosure due to a timing side-channel during PKCS#7 padding checks in gnutls. There is no impact on integrity or availability. The CVSS score of 3.7 reflects a low severity risk with network attack vector, high attack complexity, and no privileges or user interaction required.
Mitigation Recommendations
A security update for the gnutls packages that addresses this timing side-channel vulnerability is available from Red Hat. Users of Red Hat Enterprise Linux 10 versions 10 up to but not including 10.2 should apply the updated gnutls packages as provided in the Red Hat security advisories (https://access.redhat.com/errata/RHSA-2026:13274). Patch status is confirmed by the vendor advisory. No additional mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-04-02T11:07:20.944Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2026:20613","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-5419","vendor":"Red Hat"}]
Threat ID: 6a1de934e29bf47b503e849d
Added to database: 06/01/2026, 20:19:00 UTC
Last enriched: 07/21/2026, 18:54:05 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 122
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.