{"id":"CVE-2025-59058","aliases":["EUVD-2025-29041","GHSA-q7pg-9pr4-mrp2"],"status":"published","title":"httpsig-rs's HMAC verification is vulnerable to timing attack","description":"httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version 0.0.19 fixes the issue.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00283,"percentile":0.21047,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208"],"published":"2025-09-12T13:10:11Z","modified":"2026-11-11T02:47:54Z","fixes":[{"ecosystem":"crates.io","package":"httpsig","fixed_in":["0.0.19"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"httpsig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.19"}]}]},{"source":"osv","ecosystem":"crates.io","package":"httpsig","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.19"}]}]}],"products":[{"vendor":"junkurihara","product":"httpsig-rs"}],"references":[{"url":"https://github.com/junkurihara/httpsig-rs/security/advisories/GHSA-q7pg-9pr4-mrp2","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/junkurihara/httpsig-rs/commit/fc095b6ce6043bb808f5d9c4379cf697899cb458","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59058","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q7pg-9pr4-mrp2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59058.json","tags":["advisory"]},{"url":"https://github.com/junkurihara/httpsig-rs","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-59058","title":"httpsig-rs's HMAC verification is vulnerable to timing attack","description":"httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version 0.0.19 fixes the issue.","status":"published","published":"2025-09-12T13:10:11.349Z","modified":"2025-09-12T13:45:48.203Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:32:48.167635Z"}],"euvd":[{"id":"EUVD-2025-29041","description":"httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version 0.0.19 fixes the issue.","status":"published","published":"2025-09-12T13:10:11Z","modified":"2025-09-12T13:45:48Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:44.524108Z"}],"ghsa":[{"id":"GHSA-q7pg-9pr4-mrp2","title":"httpsig-rs: HMAC verification is vulnerable to timing attack","description":"### Summary\nHMAC signature comparison is not timing-safe and is vulnerable to timing attacks.\n\n### Details\n`SharedKey::sign()` returns a `Vec\u003cu8\u003e` which has a non-constant-time equality implementation.\n\n`Hmac::finalize()` returns a constant-time wrapper ([`CtOutput`](https://docs.rs/digest/0.10.7/digest/struct.CtOutput.html)) which was discarded. Alternatively, `Hmac` has a constant-time `verify()` method.\n\nThe problem reported here is due to the following lines in `SharedKey::sign()` of the previous code:\n```rust\nlet mut mac = HmacSha256::new_from_slice(key).unwrap();\nmac.update(data);\nOk(mac.finalize().into_bytes().to_vec())\n```\nand the merged update changes the third line to directly verify with `verify_slice`.\n\n### Impact\n\nAnyone who uses HS256 signature verification is vulnerably to Timing Attack that allows the attacker to forge a signature.","status":"published","published":"2025-09-12T21:11:13Z","modified":"2025-09-12T21:11:13Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:38:58.107905Z"}],"nvd":[{"id":"CVE-2025-59058","description":"httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version 0.0.19 fixes the issue.","status":"published","published":"2025-09-12T14:15:41.773Z","modified":"2026-06-17T09:45:31.167Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:11:28.834562Z"}],"osv":[{"id":"CVE-2025-59058","title":"httpsig-rs's HMAC verification is vulnerable to timing attack","description":"httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version 0.0.19 fixes the issue.","status":"published","published":"2025-09-12T13:10:11.349Z","modified":"2026-11-11T10:47:21.804046727Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"GHSA-q7pg-9pr4-mrp2","title":"httpsig-rs: HMAC verification is vulnerable to timing attack","description":"### Summary\nHMAC signature comparison is not timing-safe and is vulnerable to timing attacks.\n\n### Details\n`SharedKey::sign()` returns a `Vec\u003cu8\u003e` which has a non-constant-time equality implementation.\n\n`Hmac::finalize()` returns a constant-time wrapper ([`CtOutput`](https://docs.rs/digest/0.10.7/digest/struct.CtOutput.html)) which was discarded. Alternatively, `Hmac` has a constant-time `verify()` method.\n\nThe problem reported here is due to the following lines in `SharedKey::sign()` of the previous code:\n```rust\nlet mut mac = HmacSha256::new_from_slice(key).unwrap();\nmac.update(data);\nOk(mac.finalize().into_bytes().to_vec())\n```\nand the merged update changes the third line to directly verify with `verify_slice`.\n\n### Impact\n\nAnyone who uses HS256 signature verification is vulnerably to Timing Attack that allows the attacker to forge a signature.","status":"published","published":"2025-09-12T21:11:13Z","modified":"2025-09-12T22:13:24.081949Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:46:54.055966Z"}]}}