Every CVE Search/ Get API key

CVE-2025-59432

Timing Attack Vulnerability in SCRAM Authentication

6.6 MediumFix available

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.70%Up 0.6 points since Sep 23, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.6

Timing Attack Vulnerability in SCRAM Authentication

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

Record
CVE-2025-59432
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-208, CWE-385
Updated
2026-11-02
EUVDEUVD-2025-29670 6.6

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

Record
EUVD-2025-29670
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
GitHub AdvisoriesGHSA-3wfh-36rx-9537 6.6

Timing Attack Vulnerability in SCRAM Authentication

Impact

A timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted.

Patches

This vulnerability has been patched by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

Users should upgrade to version 3.2 or later to mitigate this issue.

Workarounds

Because the attack requires high precision and repeated attempts, the risk is limited, but the only reliable mitigation is to upgrade to a patched release (version 3.2 or later).

References

Record
GHSA-3wfh-36rx-9537
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-208, CWE-385
Updated
2026-11-02
NVD 6.6

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

Record
CVE-2025-59432
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-208, CWE-385
Updated
2026-11-02
OSV 6.6

Timing Attack Vulnerability in SCRAM Authentication

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

Record
CVE-2025-59432
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-208, CWE-385
Updated
2026-11-02
OSVDEBIAN-CVE-2025-59432 6.6

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

Record
DEBIAN-CVE-2025-59432
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 14 moreShow less
OSVGHSA-3wfh-36rx-9537 6.6

Timing Attack Vulnerability in SCRAM Authentication

Impact

A timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted.

Patches

This vulnerability has been patched by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

Users should upgrade to version 3.2 or later to mitigate this issue.

Workarounds

Because the attack requires high precision and repeated attempts, the risk is limited, but the only reliable mitigation is to upgrade to a patched release (version 3.2 or later).

References

Record
GHSA-3wfh-36rx-9537
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-208, CWE-385
Updated
2026-11-02
OSVOESA-2025-2391 6.8

ongres-scram security update

Scram is part of the family of Simple Authentication and Security Layer authentication mechanisms.It is described as part of RFC 5802 and RFC7677. This pachage is a Java implementation.

Security Fix(es):

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.(CVE-2025-59432)

Record
OESA-2025-2391
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2025-2392 6.8

ongres-scram security update

Scram is part of the family of Simple Authentication and Security Layer authentication mechanisms.It is described as part of RFC 5802 and RFC7677. This pachage is a Java implementation.

Security Fix(es):

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.(CVE-2025-59432)

Record
OESA-2025-2392
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2025-2393 6.8

ongres-scram security update

Scram is part of the family of Simple Authentication and Security Layer authentication mechanisms.It is described as part of RFC 5802 and RFC7677. This pachage is a Java implementation.

Security Fix(es):

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.(CVE-2025-59432)

Record
OESA-2025-2393
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2025-2394 6.8

ongres-scram security update

Scram is part of the family of Simple Authentication and Security Layer authentication mechanisms.It is described as part of RFC 5802 and RFC7677. This pachage is a Java implementation.

Security Fix(es):

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.(CVE-2025-59432)

Record
OESA-2025-2394
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2025-2395 6.8

ongres-scram security update

Scram is part of the family of Simple Authentication and Security Layer authentication mechanisms.It is described as part of RFC 5802 and RFC7677. This pachage is a Java implementation.

Security Fix(es):

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.(CVE-2025-59432)

Record
OESA-2025-2395
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2025-2396 6.8

ongres-scram security update

Scram is part of the family of Simple Authentication and Security Layer authentication mechanisms.It is described as part of RFC 5802 and RFC7677. This pachage is a Java implementation.

Security Fix(es):

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.(CVE-2025-59432)

Record
OESA-2025-2396
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-59432 6.6

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

Record
UBUNTU-CVE-2025-59432
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
OSVopenSUSE-SU-2025:15680-1 No score

ongres-scram-3.2-7.1 on GA media

These are all security issues fixed in the ongres-scram-3.2-7.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15680-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:20059-1 No score

Security update for ongres-scram

This update for ongres-scram fixes the following issues:

  • CVE-2025-59432: Fixed timing attack vulnerability in SCRAM Authentication (bsc#1250399)
Record
openSUSE-SU-2025:20059-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20742-1 No score

Security update for ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu

This update for ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu fixes the following issues:

Changes in ongres-scram:

  • Version 3.2

    • Fix Timing Attack Vulnerability in SCRAM Authentication (bsc#1250399, CVE-2025-59432)
    • Updated dependencies and maven plugins
    • Use central-publishing-maven-plugin to deploy to Maven Central.

  • Do not create multirelease jar if the only Java 9+ class file is module-info.class

Changes in ongres-stringprep:

  • Do not create multirelease jar if the only Java 9+ class file is module-info.class

Changes in plexus-testing:

  • The build without tests does not need the full junit5; the junit5-minimal (built with ant) is enough

Changes in maven:

  • Upgrade to upstream version 3.9.14

    • Bug Fixes

      • plexus-testing dependencies should be used in test scope

  • Upgrade to upstream version 3.9.13

    • Bug Fixes

      • Bug: SecDispatcher is managed by legacy Plexus DI
      • [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8 Java version in ranges as well

    • Maintenance

      • Update Maven plugin versions in default-bindings.xml
      • Migrate to JUnit 5 - avoid using TestCase

Changes in maven-doxia:

Upgrade to upstream version 2.1.0:

  • New features and improvements

    • Distinguish between linebreaks for formatting markup and linebreaks in output
    • Return SinkEventAttributes instead of super class MutableAttributeSet for filterAttributes
    • Optionally leave fragments of internal links untouched Support strikethrough for Markdown sink
    • DOXIA-770: Only escape when necessary
    • DOXIA-760: Clarify table justification semantics and introduce new "JUSTIFY_DEFAULT" alignment
    • DOXIA-756: Allow to customize macro execution
    • DOXIA-759: Support anchors in MarkdownSink

  • Bug Fixes

    • MarkdownSink: Fix verbatim inside table cell
    • Make sure to emit metadata prior everything else
    • Convert all globally available attributes to HTML5 compliant ones
    • Html5BaseSink: Convert non-compliant HTML5 attributes to compliant ones
    • Support "name" attribute in "a" element still in XHTML5
    • Never emit Markdown inside HTML context
    • Use JSoup to convert HTML to XHTML after parsing with Flexmark
    • DOXIA-764: Strip leading newline after
    • DOXIA-763: Distinguish between verbatim source and non-source in MarkdownSink
    • DOXIA-758: Consider emitComments flag in MarkdownSink
    • DOXIA-757: Don't strip leading "#" from link names
    • DOXIA-753: Do not end lists with a blank line
    • DOXIA-751: Linked inline code must be emitted in right order
    • DOXIA-749: Correctly indent and separate blocks inside list items
    • DOXIA-750: Properly apply inlines inside HTML blocks
    • DOXIA-747: Emit headings at beginning of line for Markdown

  • Documentation updates

    • Site: Convert APT to Markdown
    • Improve documentation of supported extensions
    • (doc) Fix missing references in JavaDocs

  • Maintenance

    • Cleanup tests
    • JUnit Jupiter best practices
    • Remove commons-lang3 and commons-text dependencies
    • feat: enable prevent branch protection rules
    • Cleanup pom, remove redundant dependencies
    • Drop almost all usages of plexus-utils
    • Remove not used and outdated clirr-maven-plugin
    • Enable Github Issues
    • DOXIA-772: Deprecate Sink.sectionTitle() and sectionTitle_()
    • DOXIA-754: Clarify method order for nested lists

Changes in mojo-parent:

  • Do not import junit-bom in the parent. This creates unnecessary build cycles with junit5.
Record
openSUSE-SU-2026:20742-1
Updated
2026-11-02
OSVSUSE-SU-2025:21016-1 No score

Security update for ongres-scram

This update for ongres-scram fixes the following issues:

  • CVE-2025-59432: Fixed timing attack vulnerability in SCRAM Authentication (bsc#1250399)
Record
SUSE-SU-2025:21016-1
Updated
2026-11-02
OSVSUSE-SU-2025:4054-1 No score

Security update for ongres-scram

This update for ongres-scram fixes the following issues:

  • CVE-2025-59432: Fixed timing attack vulnerability in SCRAM Authentication (bsc#1250399)
Record
SUSE-SU-2025:4054-1
Updated
2026-11-02
OSVSUSE-SU-2026:21608-1 No score

Security update for ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu

This update for ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu fixes the following issues:

Changes in ongres-scram:

  • Version 3.2

    • Fix Timing Attack Vulnerability in SCRAM Authentication (bsc#1250399, CVE-2025-59432)
    • Updated dependencies and maven plugins
    • Use central-publishing-maven-plugin to deploy to Maven Central.

  • Do not create multirelease jar if the only Java 9+ class file is module-info.class

Changes in ongres-stringprep:

  • Do not create multirelease jar if the only Java 9+ class file is module-info.class

Changes in plexus-testing:

  • The build without tests does not need the full junit5; the junit5-minimal (built with ant) is enough

Changes in maven:

  • Upgrade to upstream version 3.9.14

    • Bug Fixes

      • plexus-testing dependencies should be used in test scope

  • Upgrade to upstream version 3.9.13

    • Bug Fixes

      • Bug: SecDispatcher is managed by legacy Plexus DI
      • [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8 Java version in ranges as well

    • Maintenance

      • Update Maven plugin versions in default-bindings.xml
      • Migrate to JUnit 5 - avoid using TestCase

Changes in maven-doxia:

Upgrade to upstream version 2.1.0:

  • New features and improvements

    • Distinguish between linebreaks for formatting markup and linebreaks in output
    • Return SinkEventAttributes instead of super class MutableAttributeSet for filterAttributes
    • Optionally leave fragments of internal links untouched Support strikethrough for Markdown sink
    • DOXIA-770: Only escape when necessary
    • DOXIA-760: Clarify table justification semantics and introduce new "JUSTIFY_DEFAULT" alignment
    • DOXIA-756: Allow to customize macro execution
    • DOXIA-759: Support anchors in MarkdownSink

  • Bug Fixes

    • MarkdownSink: Fix verbatim inside table cell
    • Make sure to emit metadata prior everything else
    • Convert all globally available attributes to HTML5 compliant ones
    • Html5BaseSink: Convert non-compliant HTML5 attributes to compliant ones
    • Support "name" attribute in "a" element still in XHTML5
    • Never emit Markdown inside HTML context
    • Use JSoup to convert HTML to XHTML after parsing with Flexmark
    • DOXIA-764: Strip leading newline after
    • DOXIA-763: Distinguish between verbatim source and non-source in MarkdownSink
    • DOXIA-758: Consider emitComments flag in MarkdownSink
    • DOXIA-757: Don't strip leading "#" from link names
    • DOXIA-753: Do not end lists with a blank line
    • DOXIA-751: Linked inline code must be emitted in right order
    • DOXIA-749: Correctly indent and separate blocks inside list items
    • DOXIA-750: Properly apply inlines inside HTML blocks
    • DOXIA-747: Emit headings at beginning of line for Markdown

  • Documentation updates

    • Site: Convert APT to Markdown
    • Improve documentation of supported extensions
    • (doc) Fix missing references in JavaDocs

  • Maintenance

    • Cleanup tests
    • JUnit Jupiter best practices
    • Remove commons-lang3 and commons-text dependencies
    • feat: enable prevent branch protection rules
    • Cleanup pom, remove redundant dependencies
    • Drop almost all usages of plexus-utils
    • Remove not used and outdated clirr-maven-plugin
    • Enable Github Issues
    • DOXIA-772: Deprecate Sink.sectionTitle() and sectionTitle_()
    • DOXIA-754: Clarify method order for nested lists

Changes in mojo-parent:

  • Do not import junit-bom in the parent. This creates unnecessary build cycles with junit5.
Record
SUSE-SU-2026:21608-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
com.ongres.scram:scram-common
Maven
 before 3.2
3.2
libscram-java
Debian:12
 All versions, plus listed versions
2.1-13.1-13.2-13.3-13.4-1
 None known
libscram-java
Debian:13
 All versions, plus listed versions
3.1-13.2-13.3-13.4-1
 None known
libscram-java
Debian:14
 before 3.2-1, plus listed versions
3.1-1
3.2-1
com.ongres.scram:scram-common
Maven
 before 3.2, plus listed versions
3.03.1
3.2
ongres-scram
openEuler:24.03-LTS-SP2
 before 2.1-3.oe2403sp2
2.1-3.oe2403sp2
ongres-scram
openEuler:20.03-LTS-SP4
 before 2.1-2.oe2003sp4
2.1-2.oe2003sp4
ongres-scram
openEuler:22.03-LTS-SP3
 before 2.1-2.oe2203sp3
2.1-2.oe2203sp3
ongres-scram
openEuler:22.03-LTS-SP4
 before 2.1-2.oe2203sp4
2.1-2.oe2203sp4
ongres-scram
openEuler:24.03-LTS
 before 2.1-3.oe2403
2.1-3.oe2403
Show 12 moreShow less
Affected packages
PackageAffectedFixed
ongres-scram
openEuler:24.03-LTS-SP1
 before 2.1-3.oe2403sp1
2.1-3.oe2403sp1
ongres-scram
SUSE:Linux Enterprise Server 16.0
 before 3.1-160000.3.1
3.1-160000.3.1
ongres-scram
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 3.1-160000.3.1
3.1-160000.3.1
ongres-scram
SUSE:Linux Enterprise Module for Server Applications 15 SP6
 before 2.1-150400.8.5.1
2.1-150400.8.5.1
ongres-scram
SUSE:Linux Enterprise Module for Server Applications 15 SP7
 before 2.1-150400.8.5.1
2.1-150400.8.5.1
ongres-scram
openSUSE:Leap 15.6
 before 2.1-150400.8.5.1
2.1-150400.8.5.1
scram
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.15.0-10.15.0-1build10.16.0-10.16.2-1
 None known
scram
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.16.2-1build10.16.2-1build2
 None known
scram
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.16.2-3
 None known
scram
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.16.2-30.16.2-3build10.16.2-3build30.16.2-3build4
 None known
ongres-scram
openSUSE:Tumbleweed
 before 3.2-7.1
3.2-7.1
ongres-scram
openSUSE:Leap 16.0
 before 3.1-160000.3.1
3.1-160000.3.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-59432 is a medium vulnerability (CVSS 6.6) in Ongres Scram, published September 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in com.ongres.scram:scram-common 3.2.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open