CVE-2024-13939

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string

7.5 HighFix available

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.

As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)."

This is similar to CVE-2020-36829

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.37%Up 0.4 points since Mar 28, 2025

What each source reports

CVE List Score used 7.5

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.

As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)."

This is similar to CVE-2020-36829

Record: CVE-2024-13939
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-208
Updated: 2026-11-02

EUVDEUVD-2025-8542 7.5

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.

As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)."

This is similar to CVE-2020-36829

Record: EUVD-2025-8542
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-x2v7-w9j6-rqmx 7.5

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow...

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.

As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)."

This is similar to CVE-2020-36829

Record: GHSA-x2v7-w9j6-rqmx
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-203, CWE-208
Updated: 2026-11-02

NVD 7.5

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.

As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)."

This is similar to CVE-2020-36829

Record: CVE-2024-13939
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-208, CWE-203
Updated: 2026-11-02

OSV 7.5

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.

As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)."

This is similar to CVE-2020-36829

Record: CVE-2024-13939
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-208
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-13939 7.5

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)." This is similar to CVE-2020-36829

Record: DEBIAN-CVE-2024-13939
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-13939 7.5

Record: UBUNTU-CVE-2024-13939
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libstring-compare-constanttime-perl` Debian:12	All versions, plus listed versions 0.321-20.321-3	None known
`libstring-compare-constanttime-perl` Debian:13	before 0.321-3	0.321-3
`libstring-compare-constanttime-perl` Debian:14	before 0.321-3	0.321-3
`libstring-compare-constanttime-perl` Ubuntu:16.04:LTS	All versions, plus listed versions 0.310-10.311-10.311-1build1	None known
`libstring-compare-constanttime-perl` Ubuntu:18.04:LTS	All versions, plus listed versions 0.312-1build1	None known
`libstring-compare-constanttime-perl` Ubuntu:20.04:LTS	All versions, plus listed versions 0.321-10.321-1build1	None known
`libstring-compare-constanttime-perl` Ubuntu:22.04:LTS	All versions, plus listed versions 0.321-1build20.321-1build3	None known
`libstring-compare-constanttime-perl` Ubuntu:24.04:LTS	All versions, plus listed versions 0.321-2build10.321-2build20.321-2build30.321-2build4	None known
`libstring-compare-constanttime-perl` Ubuntu:25.10	All versions, plus listed versions 0.321-2build50.321-3	None known
`libstring-compare-constanttime-perl` Ubuntu:26.10	All versions, plus listed versions 0.321-30.321-3build1	None known
`libstring-compare-constanttime-perl` Ubuntu:26.04:LTS	All versions, plus listed versions 0.321-3	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-13939 is a high vulnerability (CVSS 7.5) in Fractal String::compare::constanttime, published March 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in libstring-compare-constanttime-perl 0.321-3.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

History

In short

References