CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a...

openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V

A flaw was found in OpenSSL. The optimized scalar point multiplication used for SM2 cryptographic operations on ARM64 and RISC-V architectures does not execute in constant time. An attacker capable of measuring execution times or observing processor cache-access patterns can exploit this side...

AZL-105861 CVE-2026-77696 affecting package rust 1.96.1-2

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

CVE-2026-77696

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

CVE-2026-54875

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...

CVE-2026-54875

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...

UBUNTU-CVE-2026-54875

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...

CVE-2026-77696: Observable Timing Discrepancy

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

EUVD-2026-65215

Grav: Non constant time nonce comparison in Utils::verifyNonce used for CSRF protection...

GHSA-38P6-H87P-R4CG Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

Summary Grav\Common\Utils::verifyNonce, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's === operator instead of hashequals. === on strings short circuits at the first differing byte, so the comparison time leaks how...

CVE-2026-70658

Pay is a payments engine for Ruby on Rails 6.0+. Prior to version 11.6.2 , the method Pay::Webhooks::PaddleBillingController#valid_signature? compares the computed 64-character SHA-256 HMAC against the attacker-controlled h1 token from the Paddle-Signature header using Ruby's String#== (a non-con...

CVE-2026-70658 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

CVE-2026-70658 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

CVE-2026-70658 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...

Fedora 45 : perl-Net-OAuth (2026-27bab0e213)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-27bab0e213 advisory. Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non- constant-time comparison in verify. This update...

SUSE CVE-2026-55785

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ueauthentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES and XRES with...

phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

The pure-PHP X25519 scalar multiplication in phpseclib is not constant-time. Field addition and subtraction each perform a data-dependent conditional modular reduction, so the cost of each Montgomery-ladder step is a linear function of that step's reduction count which is a quantity determined by...

GHSA-Q97C-8QH3-FPC6 phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

The pure-PHP X25519 scalar multiplication in phpseclib is not constant-time. Field addition and subtraction each perform a data-dependent conditional modular reduction, so the cost of each Montgomery-ladder step is a linear function of that step's reduction count which is a quantity determined by...

Fedora 43 : perl-Net-OAuth (2026-370bd8b5f0)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-370bd8b5f0 advisory. Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non- constant-time comparison in verify. This update...