https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 16:43:54 +0000 https://cve.radiocsirt.org/vuln/cve-2026-9537 <p><strong>Affected:</strong> JBERGER Mojo::JWT</p> <p>Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison.</p> <p>The decode() method compares the supplied signature to the recomputed HMAC with Perl&#39;s eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes.</p> <p>A caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token.</p> <p><strong>Affected:</strong> JBERGER Mojo::JWT</p> <p>Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison.</p> <p>The decode() method compares the supplied signature to the recomputed HMAC with Perl&#39;s eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes.</p> <p>A caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token.</p> https://cve.radiocsirt.org/vuln/cve-2026-9537