CWE-208: Timing Side Channel vulnerabilities

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.

CVE-2026-78500 is a medium severity vulnerability in WatchGuard Dimension version 2.0. It is a blind server-side request forgery (SSRF) issue in the Database Server Test configuration that allows an authenticated privileged attacker to enumerate network services on adjacent systems.

CVE-2026-59276 is a timing discrepancy vulnerability in Spring Security where security-sensitive string comparisons use standard equality checks instead of constant-time comparisons. This causes the time taken to reject incorrect values to vary based on the number of matching leading characters. The vulnerability affects multiple versions of Spring Security including 5.7.0 through 7.1.0. The CVSS score is 5.9, indicating medium severity.

CVE-2026-18259 is a high-severity vulnerability in the Drupal Token Content Access module, versions from 0.0.0 up to but not including 3.1.2. It involves an observable timing discrepancy (CWE-208) that can be exploited to perform brute force attacks. The vulnerability allows an attacker to infer sensitive information based on timing differences in content access responses. A fix is available in version 3.1.2.

CVE-2026-44255 is a timing discrepancy vulnerability in Wazuh's authentication mechanism. Versions from 4.0.0 up to but not including 4.14.6, and 5.0.0-beta1 up to but not including 5.0.0-beta2, perform an expensive bcrypt password hash check only when the username exists, causing different response times for valid and invalid usernames. This allows unauthenticated remote attackers to enumerate valid usernames by measuring authentication response times. The issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Net::OAuth versions before 0.33 for Perl contain a timing side-channel vulnerability in the signature verification process. The library uses non-constant-time string comparisons for HMAC-SHA1, HMAC-SHA256, and PLAINTEXT signatures, allowing an attacker to measure response times and gradually recover valid signatures or secret keys. RSA-SHA1 signatures are not affected. This vulnerability can lead to disclosure of sensitive secrets such as consumer_secret and token_secret.

Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.

Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.

Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagnetic emanation attacks, resulting in high confidentiality and integrity impact due to the exposure of private cryptographic keys.

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. Refer to TCGVRT0011.

CVE-2025-49506 is a timing side-channel vulnerability in the Apache Portable Runtime Utility (APR-util) affecting versions up to and including 1.6.3. The apr_password_validate() function did not perform password or hash comparisons in constant time, potentially allowing attackers to infer sensitive information via timing discrepancies on platforms lacking the crypt() function, such as Windows, BeOS, NetWare, or Android. The issue is fixed in version 1.6.4.

OMICRON StationScout before version 3.05 has a cryptographic timing side-channel vulnerability in its backend authentication. This flaw may allow unauthenticated attackers to forge valid credentials, bypass authentication and authorization, and impersonate legitimate clients. Successful exploitation can lead to full access to system configuration, enabling modification or unauthorized changes to system parameters and injection of network traffic.

OMICRON StationGuard before version 4.10 has a cryptographic timing side-channel vulnerability in its backend authentication mechanism. This flaw may allow an unauthenticated attacker to forge valid credentials, bypass authentication and authorization, and impersonate legitimate clients. Successful exploitation grants full access to system configuration, enabling unauthorized modification or reset of system parameters.

A timing discrepancy vulnerability exists in the pyca cryptography package versions 44.0.0 up to but not including 50.0.0. The issue involves the pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime functions which leak information about the length of the decrypted RSA encryptedKey through observable timing differences and distinct error messages. This leakage can be exploited as a Bleichenbacher oracle against the content-encryption key if an application decrypts attacker-supplied EnvelopedData and reflects the outcome. The vulnerability is fixed in version 50.0.0.

CVE-2026-8794 is a timing discrepancy vulnerability in the authentication component of PaperCut NG/MF. An unauthenticated remote attacker can exploit this issue to enumerate valid usernames by measuring response times during login attempts. The vulnerability arises because the system only performs a password hash comparison when a valid account is supplied, creating a timing oracle. This flaw can reveal account existence without authentication.

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. These are the KyberSlash1 (Poly.toMsg) and KyberSlash2 (ciphertext compression) divisions. Compression performed during encapsulation operates on values that become the public ciphertext and is not affected.

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values.

CVE-2026-15432 is a high-severity vulnerability in Google Tink-Java where the ChunkedMacVerification object uses a non-constant time comparison for verifying MAC tags. This timing discrepancy can act as a side channel, potentially allowing attackers to determine how many bytes of a tag match the correct tag, facilitating a bytewise recovery of the correct tag.

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash.