CVE-2026-65630

A flaw was found in jose. The pure-Erlang fallback implementation of the X25519 cryptographic algorithm performs operations whose execution times vary depending on the secret key. An attacker capable of submitting encrypted messages and measuring decryption response times can exploit this timing...

CVE-2026-85286

The HomeBox home inventory system is vulnerable to a timing side-channel in the POST /api/v1/users/login endpoint prior to version 0.27.0 . The application performs password-hash verification only for registered usernames, while returning immediately for unknown ones. This processing-time discrep...

AVX-Side-Channel

AVX-Based Timing Side Channel — ASLR Detection Author: Byte Reaper Description script that demonstrates ASLR detection using an AVX memory load + RDTSCP timing and optional SIGSEGV detection. Requirements : Linux x8664 GCC with -mavx2 CPU that supports AVX2 and RDTSCP Build : gcc -mavx2 -O2 file....

ssh-enum

ssh-enum Statistical Validation Study of CVE-2016-6210 A reproducible re-investigation of OpenSSH username enumeration using statistical analysis. This project re-investigates CVE-2016-6210 , a documented OpenSSH timing side-channel, to determine whether it remains observable on a modern Ubuntu...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – Post-Quantum KEM Timing Side-Channel Kyber Decapsulation Overview A vulnerable implementation of the Kyber KEM decapsulation leaks secret key bits through timing differences in the ciphertext rejection step, enabling full key recovery. Severity: Critical Private Key Compromise...

CLEANSTART-2025-ZT05905 OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack

CVE-2018-0734 affects multiple packages. The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. See references for individual vulnerability details...

CLEANSTART-2025-ZF20781 OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack

CVE-2018-0735 affects multiple packages. The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. See references for individual vulnerability details...

CLEANSTART-2024-XM17496 Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg

CVE-2020-16150 affects multiple packages. A Lucky 13 timing side channel in mbedtlsssldecryptbuf in library/sslmsg. See references for individual vulnerability details...

CLEANSTART-2026-HN70749 timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS

Security vulnerability affects the gnutls package. A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS...

CLEANSTART-2026-OA66833 NSS was susceptible to a timing side-channel attack when performing RSA decryption

Security vulnerability affects the nss package. NSS was susceptible to a timing side-channel attack when performing RSA decryption...

CVE-2023-1206-CVE-2025-40040-CVE-2024-49882

Combined Covert Channel: CVE-2023-1206 + CVE-2024-49882 Overview This project demonstrates a covert communication channel using two Linux kernel vulnerabilities: Component| CVE| Purpose ---|---|--- Sync Channel| CVE-2023-1206| Clock synchronization via IPv6 hash collision timing Data Channel|...

CVE-2026-8794

CVE-2026-8794 — Username Enumeration via Authentication Timing Side-Channel in PaperCut NG Field| Details ---|--- CVE ID| CVE-2026-8794 Product| PaperCut NG Affected Version| 25.0.11 Build 75758 and earlier CWE| CWE-208 — Observable Timing Discrepancy CVSS Score| 3.7 Low — standalone; escalates...

Apache Struts2 Core 7.4.0 Timing Side Channel

Apache Struts2 Core version 7.4.0 and below contains a timing side-channel vulnerability in TokenHelper token comparisons that may allow attackers to infer valid session token values...

OESA-2026-4639 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64...

OESA-2026-4638 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64...

Security Bulletin: UPDATED bulletin for OpenSSL vulnerabilities impacting AIX. Updated On: Tue Oct 27 12:13:54 CDT 2026. Reason: Updated the iFix link, link was pointing to openssl_fix49.tar, instead of openssl_fix50.tar. And fixed typo in summary.

Summary Vulnerabilities in OpenSSL: CVE-2026-35189 - Memory exhaustion DoS, CVE-2026-54872 - ECDSA/SM2 timing side-channel, CVE-2026-77696 - SM2 timing side-channel,CVE-2026-84782 - Out-of-Bounds Read, CVE-2026-75805 - NULL pointer dereference DoS, CVE-2026-75806 - DTLS connection termination DoS...

CVE-2026-65630

Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursiv...

Multiple vulnerabilities impact AIX due to OpenSSL

IBM SECURITY ADVISORY First Issued: Tue Oct 27 03:47:38 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/openssladvisory50.asc Security Bulletin: Multiple vulnerabilities impact AIX due to OpenSSL...

Linux Distros Unpatched Vulnerability : CVE-2026-65630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erla...

AZL-112184 CVE-2026-65630 affecting package rabbitmq-server 3.13.7-10

Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursiv...