Falhas do tipo CWE-208

212 resultados

Discrepância de Tempo Observável

É quando um programa leva tempos diferentes para processar entradas válidas versus inválidas, e esse tempo é observável por um atacante. Essa variação permite inferir informações sensíveis (como senhas ou tokens) através de ataques de timing, sem acesso direto aos dados.

Exemplo

Uma função que compara uma senha caractere por caractere, saindo assim que encontra um erro, leva menos tempo para senhas erradas no início do que para senhas quase corretas. Um atacante mede os tempos de resposta da API e descobre a senha testando caracteres até encontrar aquele que aumenta o tempo de processamento.

Como mitigar

Use comparação em tempo constante (funções como `hmac.compare()` em Node.js ou `secrets.compare()` em Python) que sempre levam o mesmo tempo independente da entrada. Adicione jitter (variação aleatória) no tempo de resposta e implemente rate limiting para dificultar medições precisas.

CVE-2026-80199MEDIUMKimai before 2.54.0 Username Enumeration via Timing OracleEPSS 0.3%CVE-2026-88010MEDIUMTraefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracleEPSS 0.3%CVE-2021-31403MEDIUMTiming side channel vulnerability in UIDL request handler in Vaadin 7 and 8EPSS 0.3%CVE-2021-34337MEDIUMAn issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the valuEPSS 0.3%CVE-2023-41097MEDIUMPotential Timing vulnerability in CBC PKCS7 padding calculationsEPSS 0.3%CVE-2026-56764MEDIUMHono - Timing Attack in basicAuth and bearerAuth MiddlewareEPSS 0.3%CVE-2026-23996LOWFastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detectionEPSS 0.3%CVE-2026-85286LOWHomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing DelayEPSS 0.3%CVE-2024-41828LOWIn JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant timeEPSS 0.3%CVE-2025-59058MEDIUMhttpsig-rs's HMAC verification is vulnerable to timing attackEPSS 0.3%CVE-2026-83535HIGHOpenstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparisonEPSS 0.3%CVE-2026-18036HIGHNTRU leaks private key information by reducing secret values with a non-constant-time integer divisionEPSS 0.3%CVE-2026-63410MEDIUMsecp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplicationEPSS 0.3%CVE-2025-54499LOWInsecure string comparison enables timing attacksEPSS 0.3%CVE-2026-69247HIGHcryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timingEPSS 0.3%CVE-2026-74846HIGHCatalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifierEPSS 0.3%CVE-2026-70437LOWJenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checkEPSS 0.3%CVE-2025-59438MEDIUMMbed TLS through 3.6.4 has an Observable Timing Discrepancy.EPSS 0.3%CVE-2026-40972HIGHAn attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote seEPSS 0.3%CVE-2026-40263LOWNote Mark: Username Enumeration via Login Endpoint Timing Side-ChannelEPSS 0.3%