Catalyst::Plugin::Authentication before 0.10029 allows timing attacks on passwords (CVE-2026-74846)
Legacy password verifier uses eq comparisons enabling timing attacks; fixed in version 0.10029.
Stories per day · 30 days
2 RSS
6 stories, newest first · one card per story
Stories tagged #timing-attack
SparseBleed infers attributes from accelerator sparsity timing
One query’s timing recovers Sex at 66.39% and Surgical Procedure at 99.8% on Texas-100X, without gradients or weights.
USN-8830-1: phpseclib vulnerabilities
Ubuntu fixes three phpseclib flaws covering AES timing leaks, SSH MAC comparison, and ASN.1 denial of service.
USN-8776-1: python-cryptography vulnerabilities
Ubuntu patches python-cryptography flaws including a PKCS#7 timing side-channel (CVE-2026-69247) that could allow key recovery.
The Illusion of Local Privacy: Confidentiality Boundary Failures in Consumer LLM Serving Systems
Researchers show local LLM serving systems leak prompts via memory residue, plaintext persistence, a llama.cpp tenant-isolation flaw, and timing oracles.
USN-8769-1: phpseclib vulnerability
Ubuntu patches phpseclib non-constant-time padding validation enabling remote padding oracle timing attacks against AES-CBC.