CVE-2024-13939

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.

As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)."

This is similar to CVE-2020-36829

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-208 CWE-203

Affected software

No affected versions have been published.

Timeline

Published: Mar 28, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-13947.5A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using CVE-2024-139405.5The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via t CVE-2024-139415.3A vulnerability was found in ouch-org ouch up to 0.3.1. It has been classified as critical. This affects the function ouch::archive::zip::co CVE-2024-139427.6Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media (SPI NOR or NAND CVE-2024-139437.8Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local att CVE-2024-139447.8Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Window CVE-2024-139456.0Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This CVE-2024-139466.8DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commi CVE-2024-139476.0Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue a CVE-2024-139487.3Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affect CVE-2024-139496.8Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials becom CVE-2024-13956.7Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU m