Weaknesses of type CWE-208

193 results

Discrepância de Tempo Observável

É quando o tempo de execução de uma operação varia dependendo do input (ex: senha, token, chave criptográfica), e essa variação é observável por um atacante. O código "vaza" informação sensível através do timing, permitindo descobrir dados sem acesso direto a eles.

Example

Uma função de validação de senha que compara caractere por caractere e retorna no primeiro erro: comparar 'abc123' (erro rápido no 1º char) vs 'abcdef' (erro mais lento no 5º char) revela ao atacante qual início de senha está correto, possibilitando brute force muito mais eficiente.

How to mitigate

Use comparações de tempo constante (constant-time comparison) para operações sensíveis, independente do resultado: bibliotecas como `hmac.compare()` em Node.js ou `secrets.compare()` em Python. Para autenticação, sempre complete o fluxo de validação antes de retornar qualquer resultado.

CVE-2025-59350LOWTiming attacks against Proxy’s basic authentication are possibleEPSS 0.3%CVE-2026-41161MEDIUMUsername Enumeration via Timing AttackEPSS 0.3%CVE-2023-25806MEDIUMTime discrepancy in authentication responses in OpenSearchEPSS 0.3%CVE-2021-26313—AMD Speculative Code Store BypassEPSS 0.3%CVE-2021-26318—Side-channels Related to the x86 PREFETCH InstructionEPSS 0.3%CVE-2024-36469LOWUser enumeration via timing attack in Zabbix web interfaceEPSS 0.3%CVE-2026-9537MEDIUMMojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparisonEPSS 0.3%CVE-2026-32702MEDIUMCleanuparr has Username Enumeration via Timing AttackEPSS 0.3%CVE-2026-54411MEDIUMLinux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password ComparisonEPSS 0.3%CVE-2026-13183HIGHRadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.3%CVE-2017-20240MEDIUMCrypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacksEPSS 0.3%CVE-2026-33129MEDIUMh3 has an observable timing discrepancy in basic auth utilsEPSS 0.3%CVE-2025-30344MEDIUMAn issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depEPSS 0.3%CVE-2026-44368MEDIUMPyQuorum: Timing side‑channel in mul_modEPSS 0.3%CVE-2026-47380MEDIUMNocoDB: User Enumeration via Sign-In TimingEPSS 0.3%CVE-2024-41741MEDIUMIBM TXSeries for Multiplatforms information disclosureEPSS 0.3%CVE-2024-0202MEDIUMCryptlib: rsa key exchange ciphersuites in tls vulnerable to marvin attackEPSS 0.3%CVE-2021-31403MEDIUMTiming side channel vulnerability in UIDL request handler in Vaadin 7 and 8EPSS 0.3%CVE-2026-16037HIGHCallback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS ModuleEPSS 0.3%CVE-2021-34337MEDIUMAn issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the valuEPSS 0.3%