CVE-2026-49265 OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

CVE-2026-49265 OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py compare attacker-supplied codeverifier values with stored challenges using ordinary string equality in...

SUSE-SU-2026:24139-1 Security update for python-oauthlib

This update for python-oauthlib fixes the following issues: - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation bsc1283526. - CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE codeverifier Comparison...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2026-013)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2OPENSSL-SNAPSAFE-2026-013 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes...

EulerOS 2.0 SP11 : apr-util (EulerOS-SA-2026-4302)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility:...

EulerOS 2.0 SP11 : apr-util (EulerOS-SA-2026-4211)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility:...

EulerOS 2.0 SP13 : apr-util (EulerOS-SA-2026-4120)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons,...

Astra Linux – Vulnerability in libgcrypt20

It was discovered that there was an ECDSA timing attack in the libgcrypt20 cryptographic library. Affected versions: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Fixed versions: 1.8.5-2 and 1.6.3-2+deb8u7...

Astra Linux – Vulnerability in Firefox and Thunderbird

The error page for sites with invalid TLS certificates lacked the activation-delay feature provided by Firefox to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page triggered user clicks at specific locations immediately before...

Astra Linux – Vulnerability in Apache2

A timing attack against modauthdigest in Apache HTTP Server 2.4.66 allows a remote attacker to bypass Digest authentication. Users are recommended to upgrade to version 2.4.67, which fixes this issue...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the GF arithmetic and the fixed-weight support sampler in HQCEngine. An attacker can recover information about the HQC private key by observing cache behavior or decapsulation timing while the code processes secret...

Timing Attack

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Timing Attack through the GF arithmetic and the fixed-weight support sampler in HQCEngine. An attacker can recover information about the HQC private key...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the GF arithmetic and the fixed-weight support sampler in HQCEngine. An attacker can recover information about the HQC private key by observing cache behavior or decapsulation timing while the code processes secret...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the GF arithmetic and the fixed-weight support sampler in HQCEngine. An attacker can recover information about the HQC private key by observing cache behavior or decapsulation timing while the code processes secret...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the GF arithmetic and the fixed-weight support sampler in HQCEngine. An attacker can recover information about the HQC private key by observing cache behavior or decapsulation timing while the code processes secret...

Timing Attack

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Timing Attack through the GF arithmetic and the fixed-weight support sampler in HQCEngine. An attacker can recover information about the HQC private...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling. An attacker can recover information about NTRU private key material by measuring t...

Timing Attack

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling. An attacker can recover information about NTRU private key material by measuring t...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling. An attacker can recover information about NTRU private key material by measuring t...