CVE-2025-59058

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version 0.0.19 fixes the issue.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-208

Affected software

No affected versions have been published.

Timeline

Published: Sep 12, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-590599.8Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to u CVE-2025-59069.8A vulnerability classified as critical has been found in code-projects Laundry System 1.0. This affects an unknown part of the file /data/. CVE-2025-590605.3Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0. Users are recommende CVE-2025-59078.8A vulnerability classified as critical was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This vulnerability affects unknown code o CVE-2025-59088.8A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This issue affects some CVE-2025-590888.6If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV CVE-2025-590895.9If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit CVE-2025-59098.8A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. Affected is an unknown functi CVE-2025-590909.3On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. There CVE-2025-590919.3Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and CVE-2025-590928.7An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe. This service is used f CVE-2025-590938.5Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from