Falhas do tipo CWE-208

192 resultados

Discrepância de Tempo Observável

É quando um programa leva tempos diferentes para processar entradas válidas versus inválidas, e esse tempo é observável por um atacante. Essa variação permite inferir informações sensíveis (como senhas ou tokens) através de ataques de timing, sem acesso direto aos dados.

Exemplo

Uma função que compara uma senha caractere por caractere, saindo assim que encontra um erro, leva menos tempo para senhas erradas no início do que para senhas quase corretas. Um atacante mede os tempos de resposta da API e descobre a senha testando caracteres até encontrar aquele que aumenta o tempo de processamento.

Como mitigar

Use comparação em tempo constante (funções como `hmac.compare()` em Node.js ou `secrets.compare()` em Python) que sempre levam o mesmo tempo independente da entrada. Adicione jitter (variação aleatória) no tempo de resposta e implemente rate limiting para dificultar medições precisas.

CVE-2026-58272MEDIUMSync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)EPSS 0.3%CVE-2026-28475MEDIUMOpenClaw < 2026.2.13 - Timing Attack via Hook Token ComparisonEPSS 0.3%CVE-2026-55785LOWfree5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKAEPSS 0.3%CVE-2025-59058MEDIUMhttpsig-rs's HMAC verification is vulnerable to timing attackEPSS 0.3%CVE-2024-41828LOWIn JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant timeEPSS 0.3%CVE-2026-25597MEDIUMPrestaShop has a time based enumeration in FO login formEPSS 0.3%CVE-2026-16731HIGHAuthentication and authorization bypass via cryptographic timing side-channel attack in StationScoutEPSS 0.3%CVE-2025-54499LOWInsecure string comparison enables timing attacksEPSS 0.3%CVE-2025-59438MEDIUMMbed TLS through 3.6.4 has an Observable Timing Discrepancy.EPSS 0.3%CVE-2026-40972HIGHAn attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote seEPSS 0.3%CVE-2026-78500MEDIUMDimension Blind SSRF via Database Test Connection FeatureEPSS 0.3%CVE-2026-16315HIGHAuthentication and authorization bypass via cryptographic timing side-channel attack in StationGuardEPSS 0.3%CVE-2026-59276MEDIUMTiming Attack via Non-Constant-Time Comparison of Sensitive ValuesEPSS 0.3%CVE-2026-81159LOWCommerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106EPSS 0.3%CVE-2026-72700HIGHGrav before 3.9.1 Timing Attack via Non-Constant-Time Token ComparisonEPSS 0.3%CVE-2026-53525HIGHWeeChat has Non-Constant-Time Password Hash Comparison in Relay AuthenticationEPSS 0.3%CVE-2025-43754MEDIUMUsername enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 throughEPSS 0.3%CVE-2020-11037MEDIUMPotential Observable Timing Discrepancy in WagtailEPSS 0.3%CVE-2026-80199MEDIUMKimai before 2.54.0 Username Enumeration via Timing OracleEPSS 0.2%CVE-2026-18259HIGHToken Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090EPSS 0.2%