ZeroDay Findings
Sign inSign up

Findings

CVE-2026-5419

A flaw was found in gnutls.

Published Jun 1, 2026 · updated Oct 14, 2026

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 1, 2026 · NIST NVD

    Detected

    A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

  3. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Sources

  • CVE.orgVulnerability recordCVE-2026-5419

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-5419

    30-day exploitation probability 0.6%

    first.org
  • NIST NVDVulnerability recordCVE-2026-5419

    A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerabi

    nvd.nist.gov

References