EUVD-2026-33755
GHSA-6452-5wg5-m56r
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (redhat) · only source for this CVE.
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.
AnalysisAI
GnuTLS's PKCS#7 padding validation during decryption is not implemented as a constant-time operation, creating a timing side-channel (CWE-208) that remote unauthenticated attackers can exploit to infer padding byte values on CBC-mode cipher suites. Affected deployments include GnuTLS as packaged across Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. Red Hat has issued patch RHSA-2026:20613; no active exploitation is confirmed in CISA KEV, and no public exploit code has been identified, but the network-reachable, no-auth-required attack surface warrants patching on systems handling sensitive encrypted traffic.
Technical ContextAI
GnuTLS is a widely deployed TLS/SSL and cryptographic library used across Red Hat Enterprise Linux and derivative platforms. The flaw resides in the PKCS#7 padding validation routine executed during symmetric-key decryption - specifically within CBC-mode cipher suites that rely on PKCS#7 block padding. CWE-208 (Observable Timing Discrepancy) captures the root cause precisely: the padding check branches or terminates at different points depending on the content of the padding bytes, causing measurable differences in processing time. This is a classic non-constant-time implementation defect. An attacker who can submit arbitrary ciphertexts for decryption and observe response latency with sufficient precision can statistically recover padding byte values across many requests, forming the basis of a timing-based padding oracle. AEAD cipher suites such as AES-GCM do not use PKCS#7 block padding and are therefore unaffected. Affected CPE strings span the GnuTLS package as shipped in cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through _10, cpe:2.3:a:red_hat:red_hat_hardened_images, and cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4.
RemediationAI
Apply the updated GnuTLS package released by Red Hat via errata RHSA-2026:20613, available at https://access.redhat.com/errata/RHSA-2026:20613. The exact patched package version should be confirmed from the errata page, as the provided input data does not enumerate a specific fixed GnuTLS version number - the patch is confirmed available per vendor advisory. As a compensating control pending patching, administrators can configure GnuTLS-based services to use only AEAD cipher suites such as AES-GCM by adjusting GnuTLS priority strings (e.g., appending ':-CIPHER-ALL:+AESGCM:+CHACHA20-POLY1305' to the priority string), which eliminates PKCS#7 block padding entirely and removes the vulnerable code path. The trade-off is reduced backward compatibility with older TLS clients that do not support AEAD cipher suites. No other workaround is known to fully mitigate the timing discrepancy without modifying cipher suite selection.
More in Red Hat Enterprise Linux 10
View allRemote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today