EUVD-2026-33755
GHSA-6452-5wg5-m56r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify GnuTLS service using CBC cipher suite
-
DeliverySend crafted ciphertext decryption requests at volume
-
ExploitMeasure per-request response timing with high precision
-
ExecutionStatistically correlate timing deltas to padding byte values
-
ImpactRecover padding oracle information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Timing attack prevention
|
| Exploitation Conditions | The target service must be running a GnuTLS-backed TLS implementation configured to use CBC-mode cipher suites that employ PKCS#7 padding (e.g., AES-128-CBC or AES-256-CBC cipher suites). The attacker must have network access to submit arbitrary ciphertexts for decryption and must be able to perform high-precision timing measurements across many repeated requests - AC:H in the CVSS vector reflects this statistical and measurement precision requirement. Services configured exclusively with AEAD cipher suites (AES-GCM, ChaCha20-Poly1305) are not vulnerable as those modes do not use PKCS#7 block padding. No authentication is required (PR:N) and no user interaction is needed (UI:N). The primary limiting factors are the high attack complexity imposed by network timing noise and the need for a large request volume, which makes this attack impractical against well-monitored services with rate limiting or anomaly detection. |
| Impact | The CVSS score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the dual reality of this issue: it is remotely reachable without authentication, but AC:H signals a meaningfully high bar for practical exploitation. Successfully recovering padding information requires submitting a large volume of crafted ciphertexts, maintaining high-precision sub-millisecond timing measurements across a network, and statistically processing the results - all of which are substantially harder in real-world network conditions with jitter. No EPSS score was included in the provided data, so exploitation probability cannot be quantified further. The vulnerability is not listed in CISA KEV, and no public POC has been identified. Confidentiality impact is rated Low (C:L), meaning information leakage is partial and bounded to padding bytes rather than plaintext content directly. For most environments this is a low-priority finding, but cryptographic library hygiene and the sensitive nature of TLS traffic processing on RHEL and OpenShift infrastructure make patching the clearly correct path. There is no conflict between the CVSS vector and the description. |
| Exploit ScenarioDerived | An attacker targets a GnuTLS-protected service using a CBC-mode TLS cipher suite, sending thousands of crafted ciphertext messages to trigger repeated decryption operations and recording the precise response time for each. By statistically correlating timing variations across this large sample set, the attacker reconstructs padding byte values, which in a worst-case padding oracle scenario could be used to make inferences about encrypted data structure. No public POC has been identified, and real-world network jitter substantially increases the number of requests and measurement precision required to mount this attack successfully. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 01, 2026
GnuTLS's PKCS#7 padding validation during decryption is not implemented as a constant-time operation, creating a timing side-channel (CWE-208) that remote unauthenticated attackers can exploit to infer padding byte values on CBC-mode cipher suites. Affected deployments include GnuTLS as packaged across Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. Red Hat has issued patch RHSA-2026:20613; no active exploitation is confirmed in CISA KEV, and no public exploit code has been identified, but the network-reachable, no-auth-required attack surface warrants patching on systems handling sensitive encrypted traffic.
RemediationAI
Apply the updated GnuTLS package released by Red Hat via errata RHSA-2026:20613, available at https://access.redhat.com/errata/RHSA-2026:20613. The exact patched package version should be confirmed from the errata page, as the provided input data does not enumerate a specific fixed GnuTLS version number - the patch is confirmed available per vendor advisory. As a compensating control pending patching, administrators can configure GnuTLS-based services to use only AEAD cipher suites such as AES-GCM by adjusting GnuTLS priority strings (e.g., appending ':-CIPHER-ALL:+AESGCM:+CHACHA20-POLY1305' to the priority string), which eliminates PKCS#7 block padding entirely and removes the vulnerable code path. The trade-off is reduced backward compatibility with older TLS clients that do not support AEAD cipher suites. No other workaround is known to fully mitigate the timing discrepancy without modifying cipher suite selection.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GnuTLS is a widely deployed TLS/SSL and cryptographic library used across Red Hat Enterprise Linux and derivative platforms. The flaw resides in the PKCS#7 padding validation routine executed during symmetric-key decryption - specifically within CBC-mode cipher suites that rely on PKCS#7 block padding. CWE-208 (Observable Timing Discrepancy) captures the root cause precisely: the padding check branches or terminates at different points depending on the content of the padding bytes, causing measurable differences in processing time. This is a classic non-constant-time implementation defect. An attacker who can submit arbitrary ciphertexts for decryption and observe response latency with sufficient precision can statistically recover padding byte values across many requests, forming the basis of a timing-based padding oracle. AEAD cipher suites such as AES-GCM do not use PKCS#7 block padding and are therefore unaffected. Affected CPE strings span the GnuTLS package as shipped in cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through _10, cpe:2.3:a:red_hat:red_hat_hardened_images, and cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (redhat) · only source for this CVE.
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Exploit-DB