Apache Struts2 Core TokenHelper uses timing side-channel for token comparisons
The token comparison in Apache Struts2 Core 7.4.0 and below uses early-exit functions like != or memcmp, creating a timing side-channel proportional to matching bytes.
Stories per day · 30 days
1 stories, newest first · one card per story