CVE-2026-33129

The CVE-2026-33129 issue affects the H3 minimal HTTP framework. A Timing Side-Channel exists in the requireBasicAuth function due to unsafe string comparison (!==), enabling an attacker to deduce the valid password character-by-character by measuring response times and bypass password protections...

PT-2026-26193

Summary A Timing Side-Channel vulnerability exists in the requireBasicAuth function due to the use of unsafe string comparison !==. This allows an attacker to deduce the valid password character-by-character by measuring the server's response time, effectively bypassing password complexity...