GnuTLS PKCS#7 Padding Timing Side-Channel Vulnerability Allowing Information Disclosure

A timing side-channel vulnerability has been identified in GnuTLS, specifically in the PKCS#7 padding check during decryption. This flaw is not constant-time, which could enable a remote attacker to infer sensitive information about the padding bytes by exploiting observable timing differences. The vulnerability affects GnuTLS versions prior to the update included in Red Hat Enterprise Linux 10.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure by allowing an attacker to infer details about the PKCS#7 padding used in encrypted messages.

Remediation

Users can apply the GnuTLS update available in the Red Hat Enterprise Linux 10 security advisory RHSA-2026:20613 to address this vulnerability.