https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 11:38:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-266344 EUVD-2026-266344 https://cve.radiocsirt.org/vuln/euvd-2026-266344 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23996 <p>FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks. All users relying on verify_key() for API key authentication prior to the fix are affected. Users should upgrade to version 1.1.0 to receive a patch. The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation. Some workarounds are available. Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied and/or use rate limiting to reduce the feasibility of statistical timing attacks.</p> <p>FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks. All users relying on verify_key() for API key authentication prior to the fix are affected. Users should upgrade to version 1.1.0 to receive a patch. The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation. Some workarounds are available. Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied and/or use rate limiting to reduce the feasibility of statistical timing attacks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23996 https://cve.radiocsirt.org/vuln/ghsa-95c6-p277-p87g <p><strong>Affected:</strong> PyPI: fastapi-api-key</p> <p>### Impact Timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks.</p> <p>Affected: all users relying on verify_key() for API key authentication prior to the fix.</p> <p>### Patches Yes. Users should upgrade to version 1.1.0 (or the version containing this fix). The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation.</p> <p>### Workarounds - Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied. - Use rate limiting to reduce the feasibility of statistical timing attacks.</p> <p>### References - CWE-208: Observable Timing Discrepancy - Commit: 87b27640f77c5ef86c46311b6b5a7e2887e35b77 - OWASP: https://owasp.org/www-community/attacks/Timing_attack</p> <p><strong>Affected:</strong> PyPI: fastapi-api-key</p> <p>### Impact Timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks.</p> <p>Affected: all users relying on verify_key() for API key authentication prior to the fix.</p> <p>### Patches Yes. Users should upgrade to version 1.1.0 (or the version containing this fix). The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation.</p> <p>### Workarounds - Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied. - Use rate limiting to reduce the feasibility of statistical timing attacks.</p> <p>### References - CWE-208: Observable Timing Discrepancy - Commit: 87b27640f77c5ef86c46311b6b5a7e2887e35b77 - OWASP: https://owasp.org/www-community/attacks/Timing_attack</p> https://cve.radiocsirt.org/vuln/ghsa-95c6-p277-p87g https://cve.radiocsirt.org/vuln/pysec-2026-1358 <p><strong>Affected:</strong> PyPI: fastapi-api-key</p> <p>### Impact Timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks.</p> <p>Affected: all users relying on verify_key() for API key authentication prior to the fix.</p> <p>### Patches Yes. Users should upgrade to version 1.1.0 (or the version containing this fix). The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation.</p> <p>### Workarounds - Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied. - Use rate limiting to reduce the feasibility of statistical timing attacks.</p> <p>### References - CWE-208: Observable Timing Discrepancy - Commit: 87b27640f77c5ef86c46311b6b5a7e2887e35b77 - OWASP: https://owasp.org/www-community/attacks/Timing_attack</p> <p><strong>Affected:</strong> PyPI: fastapi-api-key</p> <p>### Impact Timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks.</p> <p>Affected: all users relying on verify_key() for API key authentication prior to the fix.</p> <p>### Patches Yes. Users should upgrade to version 1.1.0 (or the version containing this fix). The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation.</p> <p>### Workarounds - Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied. - Use rate limiting to reduce the feasibility of statistical timing attacks.</p> <p>### References - CWE-208: Observable Timing Discrepancy - Commit: 87b27640f77c5ef86c46311b6b5a7e2887e35b77 - OWASP: https://owasp.org/www-community/attacks/Timing_attack</p> https://cve.radiocsirt.org/vuln/pysec-2026-1358