PUBLISHED
2026-07-17 16:17
MODIFIED
2026-07-17 16:17
EPSS (Prob. Exploit)
0.32%
Top 74.7%
> DESCRIPTION
Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison.
The decode() method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes.
A caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-208: Observable Timing Discrepancy - Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison
AFFECTED PACKAGES:
Unknown / Unknown
11 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
17/07/2026 16:17
Source: NVD
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-208: Observable Timing Discrepancy - Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant infor...
Total des modifications: 1
Dernière mise à jour: 3 months ago