https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 15:29:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-266442 EUVD-2026-266442 https://cve.radiocsirt.org/vuln/euvd-2026-266442 https://cve.radiocsirt.org/vuln/fkie_cve-2025-59432 <p>SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.</p> <p>SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-59432 https://cve.radiocsirt.org/vuln/ghsa-3wfh-36rx-9537 <p><strong>Affected:</strong> Maven: com.ongres.scram:scram-common</p> <p>### Impact</p> <p>A timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because `Arrays.equals` was used to compare secret values such as client proofs and server signatures. Since `Arrays.equals` performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted.</p> <p>### Patches</p> <p>This vulnerability has been patched by replacing `Arrays.equals` with `MessageDigest.isEqual`, which ensures constant-time comparison.</p> <p>Users should upgrade to version **3.2** or later to mitigate this issue.</p> <p>### Workarounds</p> <p>Because the attack requires high precision and repeated attempts, the risk is limited, but the only reliable mitigation is to upgrade to a patched release (version 3.2 or later).</p> <p>### References</p> <p>- [Java `MessageDigest.isEqual` Documentation](https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte[],byte[]))</p> <p><strong>Affected:</strong> Maven: com.ongres.scram:scram-common</p> <p>### Impact</p> <p>A timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because `Arrays.equals` was used to compare secret values such as client proofs and server signatures. Since `Arrays.equals` performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted.</p> <p>### Patches</p> <p>This vulnerability has been patched by replacing `Arrays.equals` with `MessageDigest.isEqual`, which ensures constant-time comparison.</p> <p>Users should upgrade to version **3.2** or later to mitigate this issue.</p> <p>### Workarounds</p> <p>Because the attack requires high precision and repeated attempts, the risk is limited, but the only reliable mitigation is to upgrade to a patched release (version 3.2 or later).</p> <p>### References</p> <p>- [Java `MessageDigest.isEqual` Documentation](https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte[],byte[]))</p> https://cve.radiocsirt.org/vuln/ghsa-3wfh-36rx-9537 https://cve.radiocsirt.org/vuln/oesa-2025-2391 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: ongres-scram</p> <p>Scram is part of the family of Simple Authentication and Security Layer authentication mechanisms.It is described as part of RFC 5802 and RFC7677. This pachage is a Java implementation. Security Fix(es):</p> <p>SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.(CVE-2025-59432)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: ongres-scram</p> <p>Scram is part of the family of Simple Authentication and Security Layer authentication mechanisms.It is described as part of RFC 5802 and RFC7677. This pachage is a Java implementation. Security Fix(es):</p> <p>SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.(CVE-2025-59432)</p> https://cve.radiocsirt.org/vuln/oesa-2025-2391 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15680-1 <p>ongres-scram-3.2-7.1 on GA media</p> <p>ongres-scram-3.2-7.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15680-1 https://cve.radiocsirt.org/vuln/rhsa-2026:1899 <p>ongres-scram: Timing Attack Vulnerability in SCRAM Authentication io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection</p> <p>ongres-scram: Timing Attack Vulnerability in SCRAM Authentication io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection</p> https://cve.radiocsirt.org/vuln/rhsa-2026:1899 https://cve.radiocsirt.org/vuln/suse-su-2025:21016-1 <p>Security update for ongres-scram</p> <p>Security update for ongres-scram</p> https://cve.radiocsirt.org/vuln/suse-su-2025:21016-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-59432 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: scram, Ubuntu:20.04:LTS: scram, Ubuntu:22.04:LTS: scram, Ubuntu:24.04:LTS: scram</p> <p>SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: scram, Ubuntu:20.04:LTS: scram, Ubuntu:22.04:LTS: scram, Ubuntu:24.04:LTS: scram</p> <p>SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-59432 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0325 <p>Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> <p>Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0325