CWE-208: Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
A kind of CWE-203 Observable Discrepancy.
From the CWE List. © The MITRE Corporation.
Newest
- nerdvana crypt::secretbuffer, crypt\ +1 moreCrypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks7.5 High
- enchant97 note-markNote Mark: Username Enumeration via Login Endpoint Timing Side-Channel3.7 Low
- phpseclibphpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()3.7 Low
- openclawOpenClaw < 2026.4.2 - Timing Side Channel in Shared-Secret Comparison6.3 Medium
- parse-community parse-serverParse Server has a login timing side-channel reveals user existence6.3 Medium
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +4 more +6 moreDoveadm credentials are verified using direct comparison which is susceptible to timing oracle...7.4 High
- nodejs node, node.js +1 moreA flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user...5.9 Medium
- gtsteffaniak filebrowserFileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel5.3 Medium
- traefikTraefik: BasicAuth Middleware Timing Attack Allows Username Enumeration6.3 Medium
- phpseclibphpseclib's AES-CBC unpadding susceptible to padding oracle timing attack8.2 High
- h3h3 has an observable timing discrepancy in basic auth utils5.9 Medium
- cleanuparrCleanuparr has Username Enumeration via Timing Attack6.9 Medium
@perfood/couch-authnpm@perfood/couch-auth has an Observable Timing Discrepancy7.5 HighopenclawnpmOpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access CheckNo score- openclawOpenClaw < 2026.2.12 - Timing Attack in Hooks Token Authentication8.2 High
- openclawOpenClaw < 2026.2.13 - Timing Attack via Hook Token Comparison6.3 Medium
- aws aws-lc, amazon aws-lc-fips-sys, aws-lc-sys +2 more +4 moreTiming Side-Channel in AES-CCM Tag Verification in AWS-LC8.2 High
- google androidIn drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache...7.4 High
richiePyPIOpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function4.8 Medium- honoHono - Timing Attack in basicAuth and bearerAuth Middleware6.3 Medium
- apache shiroApache Shiro: Brute force attack possible to determine valid user names1.0 Low
- triliumnext triliumTrilium Notes has a Timing Attack Vulnerability in /api/login/sync7.4 High
- prestashopPrestaShop has a time based enumeration in FO login form5.3 Medium
- djangoproject djangoUsername enumeration through timing difference in mod_wsgi authentication handler5.3 Medium
- octoprintOctoPrint has Timing Side-Channel Vulnerability in API Key Authentication6.0 Medium
- spring securitySpring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation5.3 Medium
- athroniaeth fastapi api key, fastapi-api-key +1 moreFastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection3.7 Low
- filebrowserFile Browser vulnerable to Username Enumeration via Timing Attack in /api/login5.3 Medium
- rustcrypto cmov, utils +1 moreRustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz8.9 High
- gallagher hbus devicesObservable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical...5.7 Medium
- arm mbed tlsMbed TLS through 3.6.4 has an Observable Timing Discrepancy.5.3 Medium
- arm mbed tlsMbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct...6.2 Medium
- mattermost, mattermost server +1 moreInsecure string comparison enables timing attacks3.1 Low
- divvydrive information technologies inc. webTiming-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web4.3 Medium
- dragonflyoss dragonflyTiming attacks against Proxy’s basic authentication are possible2.7 Low
- ongres scramTiming Attack Vulnerability in SCRAM Authentication6.6 Medium
- junkurihara httpsig-rshttpsig-rs's HMAC verification is vulnerable to timing attack5.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal exposes ERC which can lead to exploit the time response attack6.9 Medium
- oberon microsystems ag psa cryptoTiming side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in Oberon PSA Crypto library5.9 Medium
- oberon microsystems ag ocryptoTiming side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in ocrypto library5.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Username Enumeration Vulnerability6.9 Medium
- No product listedObservable timing discrepancy in firmware for some Intel(R) CSME and Intel(R) SPS may allow a...6.8 Medium
- riscv-boom sonicboom, boom-core risvc-boom +1 moreriscv-boom SonicBOOM L1 Data Cache timing discrepancy2.0 Low
- tryquiet quietQuiet uses insecure, inconsistent verification on local backend token8.5 High
- xml-security signxmlSignXML's signature verification with HMAC is vulnerable to a timing attack6.9 Medium
- vllmvLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel2.6 Low
- mattermost, mattermost server, ms teams +2 moreWebhook Secret Exposure via Timing attack in MSteams plugin5.3 Medium
- zabbixUser enumeration via timing attack in Zabbix web interface2.3 Low
- fractal string::compare::constanttime, string\ +1 moreString::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string7.5 High
- intevation openslidesAn issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/...5.3 Medium
- Show moreLoading…