Weaknesses of type CWE-208

161 results

Discrepância de Tempo Observável

É quando o tempo de execução de uma operação varia dependendo do input (ex: senha, token, chave criptográfica), e essa variação é observável por um atacante. O código "vaza" informação sensível através do timing, permitindo descobrir dados sem acesso direto a eles.

Example

Uma função de validação de senha que compara caractere por caractere e retorna no primeiro erro: comparar 'abc123' (erro rápido no 1º char) vs 'abcdef' (erro mais lento no 5º char) revela ao atacante qual início de senha está correto, possibilitando brute force muito mais eficiente.

How to mitigate

Use comparações de tempo constante (constant-time comparison) para operações sensíveis, independente do resultado: bibliotecas como `hmac.compare()` em Node.js ou `secrets.compare()` em Python. Para autenticação, sempre complete o fluxo de validação antes de retornar qualquer resultado.

CVE-2024-52307MEDIUMauthentik allows a timing attack due to missing constant time comparison for metrics viewEPSS 0.5%CVE-2021-21575MEDIUM Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability. EPSS 0.5%CVE-2024-47178HIGHbasic-auth-connect's callback uses time unsafe string comparisonEPSS 0.5%CVE-2024-7010HIGHTiming Attack in mudler/localaiEPSS 0.5%CVE-2024-2467MEDIUMPerl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack)EPSS 0.5%CVE-2023-25529HIGHNVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of EPSS 0.5%CVE-2024-36405MEDIUMControl-flow timing leak in Kyber reference implementation when compiled with Clang 15-18 for -Os, -O1 and other optionsEPSS 0.5%CVE-2024-31074HIGHObservable timing discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via neEPSS 0.5%CVE-2025-68621HIGHTrilium Notes has a Timing Attack Vulnerability in /api/login/syncEPSS 0.5%CVE-2026-23519HIGHRustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnzEPSS 0.5%CVE-2026-23892MEDIUMOctoPrint has Timing Side-Channel Vulnerability in API Key AuthenticationEPSS 0.5%CVE-2022-42288MEDIUMNVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, wEPSS 0.5%CVE-2024-45191MEDIUMAn issue was discovered in Matrix libolm through 3.2.16. The AES implementation is vulnerable to cache-timing attacks due to use of S-boxes.EPSS 0.5%CVE-2026-23849MEDIUMFile Browser vulnerable to Username Enumeration via Timing Attack in /api/loginEPSS 0.4%CVE-2024-3296MEDIUMRust-openssl: timing based side-channel can lead to a bleichenbacher style attackEPSS 0.4%CVE-2024-56738MEDIUMGNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.EPSS 0.4%CVE-2024-22340MEDIUMIBM Common Cryptographic Architecture information disclosureEPSS 0.4%CVE-2025-22234MEDIUMSpring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigationEPSS 0.4%CVE-2024-21671LOWvantage6 username timing attackEPSS 0.4%CVE-2026-5086HIGHCrypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacksEPSS 0.4%