A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gnutls-c++Upgrade gnutls-daneUpgrade gnutls-develUpgrade gnutls-utilsUpgrade gnutls | Jul 2, 2026 | May 26, 2026 |
| Alpine Linux | — | Upgrade gnutls | Jun 2, 2026 | Jun 1, 2026 |
| Amazon_linux_2023 | — | Upgrade gnutls-utils-debuginfoUpgrade gnutls-debugsourceUpgrade gnutls-debuginfoUpgrade gnutls-daneUpgrade gnutls-utilsUpgrade gnutls-dane-debuginfoUpgrade gnutlsUpgrade gnutls-c++Upgrade gnutls-c++-debuginfoUpgrade gnutls-devel | Jun 9, 2026 | Jun 1, 2026 |
| Debian | — | Upgrade gnutls28 | May 20, 2026 | May 20, 2026 |
| Redhat_linux | — | Upgrade gnutls-debuginfoUpgrade gnutls-c++Upgrade gnutlsNo solution existsUpgrade gnutls-dane-debuginfoUpgrade gnutls-utilsUpgrade gnutls-debugsourceUpgrade gnutls-utils-debuginfoUpgrade gnutls-c++-debuginfoUpgrade gnutls-fipsUpgrade gnutls-develUpgrade gnutls-dane | Jun 3, 2026 | Apr 29, 2026 |
| Rocky_linux | — | Upgrade gnutls-dane-debuginfoUpgrade gnutls-c++-debuginfoUpgrade gnutls-daneUpgrade gnutls-develUpgrade gnutls-fipsUpgrade gnutlsUpgrade gnutls-utils-debuginfoUpgrade gnutls-debuginfoUpgrade gnutls-c++Upgrade gnutls-utilsUpgrade gnutls-debugsource | Jun 4, 2026 | Jun 2, 2026 |
| Ubuntu | — | Upgrade libgnutls30t64Upgrade libgnutls30 | May 25, 2026 | May 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub