EUVD-2026-33755
GHSA-6452-5wg5-m56r
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (redhat) · only source for this CVE.
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.
AnalysisAI
GnuTLS's PKCS#7 padding validation during decryption is not implemented as a constant-time operation, creating a timing side-channel (CWE-208) that remote unauthenticated attackers can exploit to infer padding byte values on CBC-mode cipher suites. Affected deployments include GnuTLS as packaged across Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. Red Hat has issued patch RHSA-2026:20613; no active exploitation is confirmed in CISA KEV, and no public exploit code has been identified, but the network-reachable, no-auth-required attack surface warrants patching on systems handling sensitive encrypted traffic.
Technical ContextAI
GnuTLS is a widely deployed TLS/SSL and cryptographic library used across Red Hat Enterprise Linux and derivative platforms. The flaw resides in the PKCS#7 padding validation routine executed during symmetric-key decryption - specifically within CBC-mode cipher suites that rely on PKCS#7 block padding. CWE-208 (Observable Timing Discrepancy) captures the root cause precisely: the padding check branches or terminates at different points depending on the content of the padding bytes, causing measurable differences in processing time. This is a classic non-constant-time implementation defect. An attacker who can submit arbitrary ciphertexts for decryption and observe response latency with sufficient precision can statistically recover padding byte values across many requests, forming the basis of a timing-based padding oracle. AEAD cipher suites such as AES-GCM do not use PKCS#7 block padding and are therefore unaffected. Affected CPE strings span the GnuTLS package as shipped in cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through _10, cpe:2.3:a:red_hat:red_hat_hardened_images, and cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4.
RemediationAI
Apply the updated GnuTLS package released by Red Hat via errata RHSA-2026:20613, available at https://access.redhat.com/errata/RHSA-2026:20613. The exact patched package version should be confirmed from the errata page, as the provided input data does not enumerate a specific fixed GnuTLS version number - the patch is confirmed available per vendor advisory. As a compensating control pending patching, administrators can configure GnuTLS-based services to use only AEAD cipher suites such as AES-GCM by adjusting GnuTLS priority strings (e.g., appending ':-CIPHER-ALL:+AESGCM:+CHACHA20-POLY1305' to the priority string), which eliminates PKCS#7 block padding entirely and removes the vulnerable code path. The trade-off is reduced backward compatibility with older TLS clients that do not support AEAD cipher suites. No other workaround is known to fully mitigate the timing discrepancy without modifying cipher suite selection.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today