A padding oracle is a side channel in which an application reveals, through different error messages, timing, or behavior, whether decrypted ciphertext had valid padding. This usually matters with block ciphers in CBC mode, where plaintext must be padded to a full block before encryption. If an attacker can repeatedly submit modified ciphertext and observe the response, they can often infer bytes of the protected data without knowing the key.
Padding oracles are dangerous because they turn a decryption check into a probing tool. In real attacks, they may be used to recover session data, cookies, or other encrypted values, and in some systems the recovered or forged data can be chained into broader server-side compromise. Defenses include using authenticated encryption such as AES-GCM, returning uniform error responses, avoiding distinct decryption failures, and validating messages in constant time so attackers cannot learn which step failed.