What’s Vulnerable › Vulnerabilities

CVE-2025-59058: httpsig-rs's HMAC verification is vulnerable to timing attack

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-12 · updated 2026-06-17
• Weakness: CWE-208

Description

httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version 0.0.19 fixes the issue.

Affected products

• junkurihara httpsig-rs: before 0.0.19

References

• https://github.com/junkurihara/httpsig-rs/commit/fc095b6ce6043bb808f5d9c4379cf697899cb458
• https://github.com/junkurihara/httpsig-rs/security/advisories/GHSA-q7pg-9pr4-mrp2

Get alerted when CVE-2025-59058 or the next vulnerability affects your stack