Fallos del tipo CWE-208

193 resultados

Discrepância de Tempo Observável

A fraqueza ocorre quando o tempo de execução de uma operação sensível (como validação de senha, verificação de token ou decisão criptográfica) varia dependendo do resultado, permitindo um atacante inferir informações pela duração da resposta. Diferenças de milissegundos podem revelar se um palpite estava correto.

Ejemplo

Um sistema valida senha comparando string por string: se o primeiro caractere estiver errado, retorna erro imediatamente; se estiver certo, continua comparando o segundo. Um atacante mede o tempo de resposta e deduz o padrão correto caractere por caractere, sem precisar da senha correta.

Cómo mitigar

Use funções de comparação constante (ex: `crypto.timingSafeEqual()` em Node.js ou `hmac_equals()` em PHP) que levam o mesmo tempo independente do ponto de falha. Para operações complexas, adicione delays aleatórios ou processe sempre a operação completa antes de retornar resultado.

CVE-2026-26717MEDIUMAn issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signaturEPSS 0.4%CVE-2026-32935HIGHphpseclib's AES-CBC unpadding susceptible to padding oracle timing attackEPSS 0.4%CVE-2026-41263MEDIUMTraefik: BasicAuth middleware: timing side-channel vulnerabilityEPSS 0.4%CVE-2025-0693MEDIUMIssue with AWS Sign-in IAM User Login Flow - Possible Username EnumerationEPSS 0.4%CVE-2026-33877LOWApostropheCMS: User Enumeration via Timing Side Channel in Password Reset EndpointEPSS 0.4%CVE-2024-13939HIGHString::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret stringEPSS 0.4%CVE-2026-41588CRITICALRELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()EPSS 0.4%CVE-2026-40194LOWphpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()EPSS 0.4%CVE-2026-15041LOW389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verificationEPSS 0.4%CVE-2020-4071LOWTiming attack on django-basic-auth-ip-whitelistEPSS 0.4%CVE-2026-48859MEDIUMSSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumerationEPSS 0.4%CVE-2026-43514LOWApache Tomcat: AJP secret compared in non-constant timeEPSS 0.4%CVE-2026-48166MEDIUMFilament: Timing-based user enumeration on login pageEPSS 0.3%CVE-2024-14041HIGHML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)EPSS 0.3%CVE-2023-32694MEDIUMNon-constant time HMAC comparison in Adyen plugin in SaleorEPSS 0.3%CVE-2025-27936MEDIUMWebhook Secret Exposure via Timing attack in MSteams pluginEPSS 0.3%CVE-2025-59350LOWTiming attacks against Proxy’s basic authentication are possibleEPSS 0.3%CVE-2026-41161MEDIUMUsername Enumeration via Timing AttackEPSS 0.3%CVE-2023-25806MEDIUMTime discrepancy in authentication responses in OpenSearchEPSS 0.3%CVE-2021-26313—AMD Speculative Code Store BypassEPSS 0.3%