CVE-2017-3156

—

CVSS 3.0

7.5 high

EPSS

6%p93

Published

Aug 10, 2017 (Aug 10, 2017)

Modified

Jun 17, 2026

Description

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.

Vendors: apache
Products: cxf
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (6.3%)

In the news0 stories

No ingested article mentions this CVE yet.