CVE-2026-5419

Publication date 30 April 2026

Last updated 20 May 2026


Ubuntu priority

Description

The PKCS#7 padding check performed during decryption was not constant-time, potentially leaking information about the padding bytes through timing differences.

Status

Package Ubuntu Release Status
gnutls28 26.04 LTS resolute
Fixed 3.8.12-2ubuntu1.1
25.10 questing
Fixed 3.8.9-3ubuntu2.2
24.04 LTS noble
Fixed 3.8.3-1.1ubuntu3.6
22.04 LTS jammy
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
gnutls28

References

Related Ubuntu Security Notices (USN)

Other references


Access our resources on patching vulnerabilities