CVE-2026-5419 Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal
A timing side-channel in GnuTLS PKCS#7 padding removal allows remote attackers to leak sensitive padding byte information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5419?
CVE-2026-5419 is a low-severity vulnerability in Cert Manager support for Red Hat OpenShift release 1.17, published on 1 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.
Weakness: CWE-208
Which versions are affected by CVE-2026-5419?
How do I fix CVE-2026-5419?
Apply the vendor's patch.
Is CVE-2026-5419 being exploited?
There is no known exploitation of CVE-2026-5419 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-5419, AZL-89424, BELL-CVE-2026-5419, DEBIAN-CVE-2026-5419, ECHO-9ccd-d5ce-b1a9, GHSA-6452-5wg5-m56r.