HMAC signature comparison is not timing-safe and is vulnerable to timing attacks.
SharedKey::sign() returns a Vec<u8> which has a non-constant-time equality implementation.
Hmac::finalize() returns a constant-time wrapper (CtOutput) which was discarded. Alternatively, Hmac has a constant-time verify() method.
The problem reported here is due to the following lines in SharedKey::sign() of the previous code:
let mut mac = HmacSha256::new_from_slice(key).unwrap();
mac.update(data);
Ok(mac.finalize().into_bytes().to_vec())
and the merged update changes the third line to directly verify with verify_slice.
Anyone who uses HS256 signature verification is vulnerably to Timing Attack that allows the attacker to forge a signature.
| Score | Percentile |
|---|---|
| 0.03% | 9.99% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 5.9 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-q7pg-9pr4-mrp2 ↗ |
| CVE | CVE-2025-59058 ↗ |
| CWE id | Name |
|---|---|
| CWE-208 | Observable Timing Discrepancy |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| rust | httpsig | < 0.0.19 | 0.0.19 | — |