CWE-208.

389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• CWE-208

OP-TEE: Hisilicon HPRE PKCS#1 v1.5 Decryption Padding Oracle

• OP-TEE optee_os
• CWE-208

OP-TEE: RSA-OAEP padding oracle in NXP CAAM driver enables plaintext recovery

• OP-TEE optee_os
• CWE-208

OP-TEE: RSA-OAEP padding oracle in Hisilicon HPRE driver enables plaintext recovery

• OP-TEE optee_os
• CWE-208

pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

• CWE-208

<=11.6.1 · no fixed version yet

Coolify: Timing Attack in GitLab Webhook Token Validation

• coollabsio coolify
• CWE-208

CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path

• MIK CryptX
• CWE-208

An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing the input of an arbitrary message,…

• AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
• AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics
• CWE-208

An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing arbitrary message input, potential…

• AMD Ryzen™ 3000 Series Desktop Processors
• AMD Ryzen™ 5000 Series Desktop Processors
• CWE-208

Authenticate method auth bypass in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension

• Authentication bypass
• Weak cryptography or TLS

>=0.124.0, <0.151.0 · fixed in 0.151.0

Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption

• wolfSSL
• CWE-208

Filament: Timing-based user enumeration on login page

• CWE-208

>=4.0.0, <4.11.5 || >=5.0.0, <5.6.5 · fixed in 4.11.5, 5.6.5

PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle

• CWE-208
• CWE-385

<3.4.10 || >=4.0.0, <4.0.7 || >=4.1.0, <4.1.7 · fixed in 3.4.10, 4.0.7, 4.1.7

Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

• Linux-PAM
• CWE-208

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks

• ARODLAND Crypt::PBKDF2
• CWE-208

SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration

• Erlang OTP
• CWE-208

NocoDB: User Enumeration via Sign-In Timing

• Authentication bypass
• CWE-208

<2026.04.1 · fixed in 2026.04.1

Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

• CWE-208

<6.6.10.18 || >=6.7.0.0, <6.7.10.1 · fixed in 6.6.10.18, 6.7.10.1

Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-208

Time-based user enumeration in TREK authentication endpoint

• mauriceboe TREK
• Information disclosure
• CWE-208

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks

• JJNAPIORK Catalyst::Plugin::Authentication
• CWE-208

DES-ECB auth with timing side channel

• Netatalk
• CWE-208

Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks

• RRWO Crypt::SaltedHash
• CWE-208

memcached: In memcached before 1.6.42, password data for SASL password database authentication has a…

• memcached
• CWE-208

memcached: In memcached before 1.6.42, username data for SASL password database authentication has a…

• memcached
• CWE-208

Apache Tomcat - AJP secret compared in non-constant time

• CWE-208

<9.0.118 || >=10.1.0-M1, <10.1.55 || >=11.0.0-M1, <11.0.22 · fixed in 9.0.118, 10.1.55, 11.0.22

RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()

• inducer relate
• CWE-208

net/tcp-md5: Fix MAC comparison to be constant-time

• Linux kernel
• CWE-208

mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening

• Path traversal
• CWE-208

<2.1.1 · fixed in 2.1.1

Kanidm has non-constant-time comparison of OAuth2 client_secret

• CWE-208

<1.9.3 · fixed in 1.9.3

Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening

• SQL injection
• Information disclosure

<7.5.0 · fixed in 7.5.0

pyquorum: Timing side‑channel in mul_mod

• CWE-208

<0.2.1 · fixed in 0.2.1

Apache HTTP Server: mod_auth_digest timing attack

• Apache Software Foundation Apache HTTP Server
• CWE-208

Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

• CWE-208

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32 · fixed in 4.0.6, 3.5.14

Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware

• CWE-208

<=1.7.34 · no fixed version yet

4ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint

• RARgames 4gaBoards
• CWE-208

Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

• CWE-208

>=5.7.0, <=5.7.22 || >=5.8.0, <=5.8.24 || >=6.3.0, <=6.3.15 || >=6.4.0, <=6.4.15 || >=6.5.0, <6.5.10 || >=7.0.0, <7.0.5 · fixed in 6.5.10, 7.0.5

Kimai: Username enumeration via timing on X-AUTH-USER

• CWE-208

<2.54.0 · fixed in 2.54.0

Mojic: Observable Timing Discrepancy in HMAC Verification

• CWE-208

<2.1.4 · fixed in 2.1.4

ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint

• CWE-208

<4.29.0 · fixed in 4.29.0

Sync-in Server has Username Enumeration via Timing Attack

• CWE-208

<2.2.0 · fixed in 2.2.0

Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks

• NERDVANA Crypt::SecretBuffer
• CWE-208

Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

• CWE-208

<0.19.2-0.20260411145025-cf4c6f6acf70 · fixed in 0.19.2-0.20260411145025-cf4c6f6acf70

phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()

• CWE-208

>=0.1.1, <1.0.28 || >=2.0.0, <2.0.53 || >=3.0.0, <3.0.51 · fixed in 1.0.28, 2.0.53, 3.0.51

Parse Server has a login timing side-channel reveals user existence

• CWE-208

<8.6.74 || >=9.0.0, <9.8.0-alpha.6 · fixed in 8.6.74, 9.8.0-alpha.6

OpenClaw: Shared-secret comparison call sites leaked length information through timing

• CWE-208

<2026.4.2 · fixed in 2026.4.2

node: A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating…

• node
• CWE-208

Improper authentication in Open-Xchange GmbH OX Dovecot Pro

• Open-Xchange GmbH OX Dovecot Pro
• Authentication bypass
• CWE-208

FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

• CWE-208

<0.0.0-20260317230626-af08800667b8 · fixed in 0.0.0-20260317230626-af08800667b8

Traefik Affected by BasicAuth Middleware Timing Attack Allows Username Enumeration

• CWE-208

<=1.7.34 · no fixed version yet

phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack

• CWE-208

>=0.1.1, <1.0.27 || >=2.0.0, <2.0.52 || >=3.0.0, <3.0.50 · fixed in 1.0.27, 2.0.52, 3.0.50

h3 has an observable timing discrepancy in basic auth utils

• CWE-208

>=2.0.0-beta.0, <2.0.1-rc.9 · fixed in 2.0.1-rc.9

Cleanuparr has Username Enumeration via Timing Attack

• Cleanuparr
• CWE-208

@perfood/couch-auth has an Observable Timing Discrepancy

• CWE-208

<=0.26.0 · no fixed version yet

AWS-LC has Timing Side-Channel in AES-CCM Tag Verification

• CWE-208

>=0.13.0, <0.13.12 · fixed in 0.13.12

OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check

• Denial of service
• CWE-208

<2026.2.24 · fixed in 2026.2.24

OpenClaw has non-constant-time token comparison in hooks authentication

• CWE-208

<2026.2.12 · fixed in 2026.2.12

OpenClaw: Config writes could persist resolved ${VAR} secrets to disk

• CWE-208

<2026.2.13 · fixed in 2026.2.13

In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure.

• Google Android
• CWE-208

OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function

• CWE-208

<3.3.0 · fixed in 3.3.0