By weakness (CWE)

CWE-208: related vulnerabilities

CVEs classified under CWE-208. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

15 published vulnerabilities

• CVE-2026-6291MEDIUM 6.5

  wolfSSL's PKCS#7 encryption decryption contains a timing-based information leak that allows attackers to recover encryption keys. When decrypting encrypted messages using RSA, the library returned different error messages depending on whether the encryption padding was valid or the message contents were corrupt. An attacker with network access could exploit this distinction by sending specially crafted encrypted messages and analyzing the responses to gradually reconstruct the underlying encryption key, similar to historical Bleichenbacher attacks. The vulnerability requires authenticated access (login credentials) and affects confidentiality of encrypted data but not integrity or system availability.

• CVE-2017-20240MEDIUM 5.9

  Crypt::PBKDF2, a Perl cryptographic library used to derive secure keys from passwords, contains a timing-based side-channel vulnerability in versions before 0.261630. The library uses a simple string comparison (eq) to verify derived keys, which executes at different speeds depending on how many characters match between the input and the correct value. An attacker on the network can measure these timing differences to gradually narrow down the correct key without needing the password itself.

• CVE-2026-54411MEDIUM 5.9

  Linux-PAM versions up to 1.7.2 contain a timing-based weakness in the pam_userdb authentication module that allows attackers to gradually recover user passwords through careful measurement of how long authentication attempts take to fail. When pam_userdb is configured to compare passwords without encryption (plaintext mode), the module's character-by-character comparison inadvertently reveals password length and individual characters by responding faster or slower depending on where the first mismatch occurs. An attacker with repeated access to an authentication service—either locally or from the network—can exploit this to systematically guess passwords one byte at a time.

• CVE-2026-45410MEDIUM 5.3

  TREK, a collaborative travel planning application, contains a user enumeration vulnerability in its login process that allows attackers to determine whether specific email addresses have accounts in the system. The flaw stems from a timing discrepancy: when a user submits a login attempt with a valid email address, the backend takes approximately 370 milliseconds to complete its password check before denying access. For non-existent accounts, the system responds in roughly 10 milliseconds. This 14-fold difference in response time leaks account existence information without any change in HTTP status codes or error messages, making it detectable through simple response timing analysis. The issue has been resolved in version 3.0.18.

• CVE-2026-48166MEDIUM 5.3

  Filament, a popular Laravel development framework, contains a timing-based information disclosure vulnerability in its login page. An unauthenticated attacker can exploit a measurable delay difference in login responses to determine whether a given email address is registered in the system. The flaw affects versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4. While the exposure is limited to account enumeration—confirming email existence without gaining unauthorized access—this reconnaissance capability can support targeted phishing, account takeover attempts, or social engineering campaigns. The vulnerability has been patched in versions 4.11.5 and 5.6.5.

• CVE-2026-48859MEDIUM 5.3

  A timing side-channel vulnerability in Erlang/OTP's SSH implementation allows attackers to discover valid usernames on an SSH server without authentication. When certain password authentication methods are enabled, the SSH daemon takes noticeably longer (~300ms) to reject logins for real usernames than for fake ones (~0ms). An attacker can exploit this timing difference to enumerate valid user accounts by measuring response times across many login attempts. The vulnerability only affects SSH servers using the legacy user_passwords or password configuration options, which are documented as test-only features; production deployments using the recommended pwdfun alternative are unaffected.

• CVE-2026-59218MEDIUM 5.3

  Open WebUI versions before 0.10.0 contain a user enumeration vulnerability in the sign-in endpoint. The flaw allows an attacker to determine whether an email address is registered by measuring response times: accounts that exist take longer to reject (because the system verifies a password), while non-existent accounts are rejected faster. This leaks information about registered users without needing valid credentials.

• CVE-2026-27882MEDIUM 4.8

  Coolify, an open-source platform for server and application management, contains a vulnerability in how it validates GitLab webhook requests. The flaw stems from using a standard string comparison method that takes slightly different amounts of time depending on where characters match or differ. An attacker can exploit this timing difference—measuring how long the validation takes—to systematically guess the webhook secret token character by character, similar to picking a lock by listening for clicks. The vulnerability affects versions prior to 4.0.0-beta.461 and is resolved in that beta release.

• CVE-2026-13758LOW 3.7

  CryptX is a Perl cryptography library that implements authenticated encryption (AEAD) modes for securing data. A timing vulnerability exists in how the library verifies authentication tags when decrypting data in streaming mode. Instead of using a constant-time comparison, the library's decrypt_done() function compares tags byte-by-byte in a way that leaks information through execution time—it returns faster when more bytes match. An attacker with precise timing measurements could exploit this to forge valid authenticated messages by testing candidate tags and observing which ones take longest to reject, effectively reading the correct tag one byte at a time. This affects GCM, CCM, ChaCha20Poly1305, EAX, and OCB modes, though the single-shot decryption functions remain unaffected.

• CVE-2026-15041LOW 3.7

  389 Directory Server contains a timing-based information disclosure vulnerability in its PBKDF2-SHA256 password hashing implementation. Instead of using a constant-time comparison function, the server uses standard memcmp() to verify password hashes during LDAP authentication. While an attacker could theoretically measure minute timing differences across many bind attempts to extract partial hash information, the practical difficulty is extremely high due to PBKDF2's intentional computational overhead. This is a low-severity issue affecting authentication security rather than availability or integrity.

• CVE-2026-48011LOW 3.7

  Shopware, a popular open-source e-commerce platform, contains a timing-based vulnerability that allows an attacker to discover the usernames of administrator accounts without authentication. By measuring response times during login attempts, an attacker can infer whether a given username belongs to an administrator by observing slight differences in how the system processes valid versus invalid accounts. This is a low-severity issue because it only leaks usernames—not passwords—and requires network access and careful measurement to exploit.

• CVE-2026-5419LOW 3.7

  A timing vulnerability has been discovered in GnuTLS, a widely-used encryption library. When the library decrypts data protected with PKCS#7 padding, the padding verification process takes different amounts of time depending on the content of the padding bytes. An attacker with network access could measure these timing differences to infer information about the padding, potentially revealing details about encrypted messages. This is a subtle flaw that requires precise network-level observation to exploit, making it a low-risk issue in most environments, but one that sophisticated attackers targeting high-value communications might attempt.

• CVE-2026-41514LOW 2.5

  OP-TEE, a security processor for Arm-based systems, has a weakness in how it decrypts RSA-encrypted data when using Hisilicon hardware acceleration. The flaw allows an attacker who can send specially crafted encrypted messages to gradually extract the original plaintext—similar to attacks on poorly implemented encryption padding schemes. This requires approximately 1000–2000 attempts and local system access, making it a low-risk issue in most deployments. The vulnerability exists only when a specific optional hardware driver is enabled, and it is disabled by default.

• CVE-2026-41515LOW 2.5

  OP-TEE, a security technology that runs on Arm processors, contains a flaw in how it decrypts certain encrypted messages. The vulnerability allows an attacker with local access to recover the contents of RSA-OAEP encrypted data by sending many specially crafted messages and observing how the system responds. The flaw stems from a timing-sensitive implementation detail that inadvertently leaks information about decryption failures. While the recovery process requires thousands of attempts, the theoretical risk is real for systems processing sensitive encrypted material. The issue affects OP-TEE versions 3.9.0 through 4.10.x; patched version 4.11.0 is available.

• CVE-2026-41516LOW 2.5

  OP-TEE, a security layer that runs trusted code on Arm processors, contains a flaw in how it decrypts RSA-encrypted messages when using Hisilicon hardware accelerators. The vulnerability allows an attacker with local access to recover the original encrypted data through timing analysis—observing slight differences in how long decryption takes depending on the input. This is a well-known class of attack against RSA encryption implementations that fail to run in constant time. The issue affects OP-TEE versions 4.5.0 through 4.10.x and is resolved in version 4.11.0.