Weaknesses of type CWE-208

193 results

Discrepância de Tempo Observável

É quando o tempo de execução de uma operação varia dependendo do input (ex: senha, token, chave criptográfica), e essa variação é observável por um atacante. O código "vaza" informação sensível através do timing, permitindo descobrir dados sem acesso direto a eles.

Example

Uma função de validação de senha que compara caractere por caractere e retorna no primeiro erro: comparar 'abc123' (erro rápido no 1º char) vs 'abcdef' (erro mais lento no 5º char) revela ao atacante qual início de senha está correto, possibilitando brute force muito mais eficiente.

How to mitigate

Use comparações de tempo constante (constant-time comparison) para operações sensíveis, independente do resultado: bibliotecas como `hmac.compare()` em Node.js ou `secrets.compare()` em Python. Para autenticação, sempre complete o fluxo de validação antes de retornar qualquer resultado.

CVE-2023-41097MEDIUMPotential Timing vulnerability in CBC PKCS7 padding calculationsEPSS 0.3%CVE-2026-23996LOWFastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detectionEPSS 0.3%CVE-2026-56764MEDIUMHono - Timing Attack in basicAuth and bearerAuth MiddlewareEPSS 0.3%CVE-2025-46570LOWvLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-ChannelEPSS 0.3%CVE-2026-58272MEDIUMSync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)EPSS 0.3%CVE-2026-28475MEDIUMOpenClaw < 2026.2.13 - Timing Attack via Hook Token ComparisonEPSS 0.3%CVE-2026-55785LOWfree5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKAEPSS 0.3%CVE-2025-59058MEDIUMhttpsig-rs's HMAC verification is vulnerable to timing attackEPSS 0.3%CVE-2024-41828LOWIn JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant timeEPSS 0.3%CVE-2026-25597MEDIUMPrestaShop has a time based enumeration in FO login formEPSS 0.3%CVE-2026-16731HIGHAuthentication and authorization bypass via cryptographic timing side-channel attack in StationScoutEPSS 0.3%CVE-2025-54499LOWInsecure string comparison enables timing attacksEPSS 0.3%CVE-2025-59438MEDIUMMbed TLS through 3.6.4 has an Observable Timing Discrepancy.EPSS 0.3%CVE-2026-40972HIGHAn attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote seEPSS 0.3%CVE-2026-78500MEDIUMDimension Blind SSRF via Database Test Connection FeatureEPSS 0.3%CVE-2026-16315HIGHAuthentication and authorization bypass via cryptographic timing side-channel attack in StationGuardEPSS 0.3%CVE-2026-59276MEDIUMTiming Attack via Non-Constant-Time Comparison of Sensitive ValuesEPSS 0.3%CVE-2026-81159LOWCommerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106EPSS 0.3%CVE-2026-72700HIGHGrav before 3.9.1 Timing Attack via Non-Constant-Time Token ComparisonEPSS 0.3%CVE-2026-53525HIGHWeeChat has Non-Constant-Time Password Hash Comparison in Relay AuthenticationEPSS 0.3%