# CVE-2026-5419: Guntls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal CVE-2026-5419 is fixed in 16 products on 1 platform, first by RHSA-2026:26409, released May 4, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-5419 - Priority: High - CVSS: 8.2 (Low) - EPSS: 0.0054 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 29, 2026 - Weakness: Observable Timing Discrepancy - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5419 ## Description The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009) * gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845) * gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010) * gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833) * gnutls: Fix intersecting empty name constraints (CVE-2026-42011) * gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | gnutls RHEL 10 | 3.8.9-9.el10_0.19 | [RHSA-2026:26409](https://patchblox.com/security/data/fix/linux/rhsa-2026-26409.md) | May 4, 2026 | | Linux | gnutls RHEL 9 | 0:3.8.10-4.el9_8 | [RHSA-2026:20612](https://patchblox.com/security/data/fix/linux/rhsa-2026-20612.md) | Jun 24, 2026 | | Linux | gnutls almalinux 10 | 3.8.10-4.el10_2 | [ALSA-2026:20613](https://patchblox.com/security/data/fix/linux/alsa-2026-20613.md) | May 26, 2026 | | Linux | gnutls almalinux 9 | 3.8.10-4.el9_8 | [ALSA-2026:20612](https://patchblox.com/security/data/fix/linux/alsa-2026-20612.md) | May 26, 2026 | | Linux | gnutls amzn 2023 | 3.8.10-4.amzn2023.0.2 | [ALAS2023-2026-1808](https://patchblox.com/security/data/fix/linux/alas2023-2026-1808.md) | Jun 8, 2026 | | Linux | gnutls ol 10 | 0:3.8.10-4.el10_2 | [ELSA-2026-20613](https://patchblox.com/security/data/fix/linux/elsa-2026-20613.md) | Jul 17, 2026 | | Linux | gnutls ol 9 | 0:3.8.10-4.el9_8 | [ELSA-2026-20612](https://patchblox.com/security/data/fix/linux/elsa-2026-20612.md) | Jun 24, 2026 | | Linux | gnutls rocky 10 | 0:3.8.10-4.el10_2 | [RLSA-2026:20613](https://patchblox.com/security/data/fix/linux/rlsa-2026-20613.md) | Jun 5, 2026 | | Linux | gnutls rocky 9 | 0:3.8.10-4.el9_8 | [RLSA-2026:20612](https://patchblox.com/security/data/fix/linux/rlsa-2026-20612.md) | Jun 2, 2026 | | Linux | gnutls-bin Ubuntu 24.04.5 LTS (noble) | 3.8.3-1.1ubuntu3.6 | [gnutls-bin 3.8.3-1.1ubuntu3.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gnutls-bin-3.8.3-1.1ubuntu3.6.md) | May 27, 2026 | | Linux | gnutls-bin Ubuntu 25.10 (questing) | 3.8.9-3ubuntu2.2 | [gnutls-bin 3.8.9-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-gnutls-bin-3.8.9-3ubuntu2.2.md) | May 27, 2026 | | Linux | gnutls-bin Ubuntu 26.04.1 LTS (resolute) | 3.8.12-2ubuntu1.1 | [gnutls-bin 3.8.12-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gnutls-bin-3.8.12-2ubuntu1.1.md) | May 7, 2026 | | Linux | gnutls-c++ RHEL 9 | 0:3.8.10-4.el9_8 | [RHSA-2026:20612](https://patchblox.com/security/data/fix/linux/rhsa-2026-20612.md) | Jun 24, 2026 | | Linux | gnutls-c++ almalinux 10 | 3.8.10-4.el10_2 | [ALSA-2026:20613](https://patchblox.com/security/data/fix/linux/alsa-2026-20613.md) | May 26, 2026 | | Linux | gnutls-c++ almalinux 9 | 3.8.10-4.el9_8 | [ALSA-2026:20612](https://patchblox.com/security/data/fix/linux/alsa-2026-20612.md) | May 26, 2026 | | Linux | gnutls-c++ amzn 2023 | 3.8.10-4.amzn2023.0.2 | [ALAS2023-2026-1808](https://patchblox.com/security/data/fix/linux/alas2023-2026-1808.md) | Jun 8, 2026 | | Linux | gnutls-c++ ol 10 | 0:3.8.10-4.el10_2 | [ELSA-2026-20613](https://patchblox.com/security/data/fix/linux/elsa-2026-20613.md) | Jul 17, 2026 | | Linux | gnutls-c++ ol 9 | 0:3.8.10-4.el9_8 | [ELSA-2026-20612](https://patchblox.com/security/data/fix/linux/elsa-2026-20612.md) | Jun 24, 2026 | | Linux | gnutls-c++-debuginfo amzn 2023 | 3.8.10-4.amzn2023.0.2 | [ALAS2023-2026-1808](https://patchblox.com/security/data/fix/linux/alas2023-2026-1808.md) | Jun 8, 2026 | | Linux | gnutls-dane RHEL 9 | 0:3.8.10-4.el9_8 | [RHSA-2026:20612](https://patchblox.com/security/data/fix/linux/rhsa-2026-20612.md) | Jun 24, 2026 | | Linux | gnutls-dane almalinux 10 | 3.8.10-4.el10_2 | [ALSA-2026:20613](https://patchblox.com/security/data/fix/linux/alsa-2026-20613.md) | May 26, 2026 | | Linux | gnutls-dane almalinux 9 | 3.8.10-4.el9_8 | [ALSA-2026:20612](https://patchblox.com/security/data/fix/linux/alsa-2026-20612.md) | May 26, 2026 | | Linux | gnutls-dane amzn 2023 | 3.8.10-4.amzn2023.0.2 | [ALAS2023-2026-1808](https://patchblox.com/security/data/fix/linux/alas2023-2026-1808.md) | Jun 8, 2026 | | Linux | gnutls-dane ol 10 | 0:3.8.10-4.el10_2 | [ELSA-2026-20613](https://patchblox.com/security/data/fix/linux/elsa-2026-20613.md) | Jul 17, 2026 | | Linux | gnutls-dane ol 9 | 0:3.8.10-4.el9_8 | [ELSA-2026-20612](https://patchblox.com/security/data/fix/linux/elsa-2026-20612.md) | Jun 24, 2026 | | Linux | gnutls-dane-debuginfo amzn 2023 | 3.8.10-4.amzn2023.0.2 | [ALAS2023-2026-1808](https://patchblox.com/security/data/fix/linux/alas2023-2026-1808.md) | Jun 8, 2026 | | Linux | gnutls-debuginfo amzn 2023 | 3.8.10-4.amzn2023.0.2 | [ALAS2023-2026-1808](https://patchblox.com/security/data/fix/linux/alas2023-2026-1808.md) | Jun 8, 2026 | | Linux | gnutls-debugsource amzn 2023 | 3.8.10-4.amzn2023.0.2 | [ALAS2023-2026-1808](https://patchblox.com/security/data/fix/linux/alas2023-2026-1808.md) | Jun 8, 2026 | | Linux | gnutls-devel RHEL 9 | 0:3.8.10-4.el9_8 | [RHSA-2026:20612](https://patchblox.com/security/data/fix/linux/rhsa-2026-20612.md) | Jun 24, 2026 | | Linux | gnutls-devel almalinux 10 | 3.8.10-4.el10_2 | [ALSA-2026:20613](https://patchblox.com/security/data/fix/linux/alsa-2026-20613.md) | May 26, 2026 | | Linux | gnutls-devel almalinux 9 | 3.8.10-4.el9_8 | [ALSA-2026:20612](https://patchblox.com/security/data/fix/linux/alsa-2026-20612.md) | May 26, 2026 | | Linux | gnutls-devel amzn 2023 | 3.8.10-4.amzn2023.0.2 | [ALAS2023-2026-1808](https://patchblox.com/security/data/fix/linux/alas2023-2026-1808.md) | Jun 8, 2026 | | Linux | gnutls-devel ol 10 | 0:3.8.10-4.el10_2 | [ELSA-2026-20613](https://patchblox.com/security/data/fix/linux/elsa-2026-20613.md) | Jul 17, 2026 | | Linux | gnutls-devel ol 9 | 0:3.8.10-4.el9_8 | [ELSA-2026-20612](https://patchblox.com/security/data/fix/linux/elsa-2026-20612.md) | Jun 24, 2026 | | Linux | gnutls-fips almalinux 10 | 3.8.10-4.el10_2 | [ALSA-2026:20613](https://patchblox.com/security/data/fix/linux/alsa-2026-20613.md) | May 26, 2026 | | Linux | gnutls-fips ol 10 | 0:3.8.10-4.el10_2 | [ELSA-2026-20613](https://patchblox.com/security/data/fix/linux/elsa-2026-20613.md) | Jul 17, 2026 | | Linux | gnutls-utils RHEL 9 | 0:3.8.10-4.el9_8 | [RHSA-2026:20612](https://patchblox.com/security/data/fix/linux/rhsa-2026-20612.md) | Jun 24, 2026 | | Linux | gnutls-utils almalinux 10 | 3.8.10-4.el10_2 | [ALSA-2026:20613](https://patchblox.com/security/data/fix/linux/alsa-2026-20613.md) | May 26, 2026 | | Linux | gnutls-utils almalinux 9 | 3.8.10-4.el9_8 | [ALSA-2026:20612](https://patchblox.com/security/data/fix/linux/alsa-2026-20612.md) | May 26, 2026 | | Linux | gnutls-utils amzn 2023 | 3.8.10-4.amzn2023.0.2 | [ALAS2023-2026-1808](https://patchblox.com/security/data/fix/linux/alas2023-2026-1808.md) | Jun 8, 2026 | | Linux | gnutls-utils ol 10 | 0:3.8.10-4.el10_2 | [ELSA-2026-20613](https://patchblox.com/security/data/fix/linux/elsa-2026-20613.md) | Jul 17, 2026 | | Linux | gnutls-utils ol 9 | 0:3.8.10-4.el9_8 | [ELSA-2026-20612](https://patchblox.com/security/data/fix/linux/elsa-2026-20612.md) | Jun 24, 2026 | | Linux | gnutls-utils-debuginfo amzn 2023 | 3.8.10-4.amzn2023.0.2 | [ALAS2023-2026-1808](https://patchblox.com/security/data/fix/linux/alas2023-2026-1808.md) | Jun 8, 2026 | | Linux | gnutls28 Debian 12.15 (bookworm) | 3.7.9-2+deb12u7 | [DEBIAN-CVE-2026-5419](https://patchblox.com/security/data/fix/linux/debian-cve-2026-5419.md) | May 15, 2026 | | Linux | gnutls28 Debian 13.5 (trixie) | 3.8.9-3+deb13u4 | [DEBIAN-CVE-2026-5419](https://patchblox.com/security/data/fix/linux/debian-cve-2026-5419.md) | May 15, 2026 | | Linux | gnutls28 Debian 14 | 3.8.13-1 | [DEBIAN-CVE-2026-5419](https://patchblox.com/security/data/fix/linux/debian-cve-2026-5419.md) | May 15, 2026 | | Linux | libgnutls-dane0t64 Ubuntu 24.04.5 LTS (noble) | 3.8.3-1.1ubuntu3.6 | [libgnutls-dane0t64 3.8.3-1.1ubuntu3.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libgnutls-dane0t64-3.8.3-1.1ubuntu3.6.md) | May 27, 2026 | | Linux | libgnutls-dane0t64 Ubuntu 25.10 (questing) | 3.8.9-3ubuntu2.2 | [libgnutls-dane0t64 3.8.9-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libgnutls-dane0t64-3.8.9-3ubuntu2.2.md) | May 27, 2026 | | Linux | libgnutls-dane0t64 Ubuntu 26.04.1 LTS (resolute) | 3.8.12-2ubuntu1.1 | [libgnutls-dane0t64 3.8.12-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libgnutls-dane0t64-3.8.12-2ubuntu1.1.md) | May 7, 2026 | | Linux | libgnutls-openssl27t64 Ubuntu 24.04.5 LTS (noble) | 3.8.3-1.1ubuntu3.6 | [libgnutls-openssl27t64 3.8.3-1.1ubuntu3.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libgnutls-openssl27t64-3.8.3-1.1ubuntu3.6.md) | May 27, 2026 | | Linux | libgnutls-openssl27t64 Ubuntu 25.10 (questing) | 3.8.9-3ubuntu2.2 | [libgnutls-openssl27t64 3.8.9-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libgnutls-openssl27t64-3.8.9-3ubuntu2.2.md) | May 27, 2026 | | Linux | libgnutls-openssl27t64 Ubuntu 26.04.1 LTS (resolute) | 3.8.12-2ubuntu1.1 | [libgnutls-openssl27t64 3.8.12-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libgnutls-openssl27t64-3.8.12-2ubuntu1.1.md) | May 7, 2026 | | Linux | libgnutls30t64 Ubuntu 24.04.5 LTS (noble) | 3.8.3-1.1ubuntu3.6 | [libgnutls30t64 3.8.3-1.1ubuntu3.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libgnutls30t64-3.8.3-1.1ubuntu3.6.md) | May 27, 2026 | | Linux | libgnutls30t64 Ubuntu 25.10 (questing) | 3.8.9-3ubuntu2.2 | [libgnutls30t64 3.8.9-3ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libgnutls30t64-3.8.9-3ubuntu2.2.md) | May 27, 2026 | | Linux | libgnutls30t64 Ubuntu 26.04.1 LTS (resolute) | 3.8.12-2ubuntu1.1 | [libgnutls30t64 3.8.12-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libgnutls30t64-3.8.12-2ubuntu1.1.md) | May 7, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.