Weaknesses of type CWE-208

193 results

Discrepância de Tempo Observável

É quando o tempo de execução de uma operação varia dependendo do input (ex: senha, token, chave criptográfica), e essa variação é observável por um atacante. O código "vaza" informação sensível através do timing, permitindo descobrir dados sem acesso direto a eles.

Example

Uma função de validação de senha que compara caractere por caractere e retorna no primeiro erro: comparar 'abc123' (erro rápido no 1º char) vs 'abcdef' (erro mais lento no 5º char) revela ao atacante qual início de senha está correto, possibilitando brute force muito mais eficiente.

How to mitigate

Use comparações de tempo constante (constant-time comparison) para operações sensíveis, independente do resultado: bibliotecas como `hmac.compare()` em Node.js ou `secrets.compare()` em Python. Para autenticação, sempre complete o fluxo de validação antes de retornar qualquer resultado.

CVE-2026-77582MEDIUMTinyauth: User enumeration attack by timing oracleEPSS 0.4%CVE-2026-5419LOWGnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removalEPSS 0.4%CVE-2025-70949HIGHAn observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.EPSS 0.4%CVE-2025-49506HIGHApache Portable Runtime Utility: apr_password_validate() vulnerable to timing attackEPSS 0.4%CVE-2026-26717MEDIUMAn issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signaturEPSS 0.4%CVE-2026-32935HIGHphpseclib's AES-CBC unpadding susceptible to padding oracle timing attackEPSS 0.4%CVE-2026-41263MEDIUMTraefik: BasicAuth middleware: timing side-channel vulnerabilityEPSS 0.4%CVE-2025-0693MEDIUMIssue with AWS Sign-in IAM User Login Flow - Possible Username EnumerationEPSS 0.4%CVE-2026-33877LOWApostropheCMS: User Enumeration via Timing Side Channel in Password Reset EndpointEPSS 0.4%CVE-2024-13939HIGHString::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret stringEPSS 0.4%CVE-2026-41588CRITICALRELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()EPSS 0.4%CVE-2026-40194LOWphpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()EPSS 0.4%CVE-2026-15041LOW389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verificationEPSS 0.4%CVE-2020-4071LOWTiming attack on django-basic-auth-ip-whitelistEPSS 0.4%CVE-2026-48859MEDIUMSSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumerationEPSS 0.4%CVE-2026-43514LOWApache Tomcat: AJP secret compared in non-constant timeEPSS 0.4%CVE-2024-14041HIGHML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)EPSS 0.3%CVE-2026-48166MEDIUMFilament: Timing-based user enumeration on login pageEPSS 0.3%CVE-2023-32694MEDIUMNon-constant time HMAC comparison in Adyen plugin in SaleorEPSS 0.3%CVE-2025-27936MEDIUMWebhook Secret Exposure via Timing attack in MSteams pluginEPSS 0.3%