timing side channel

Microsoft published CVE-2026-47783 on May 21, 2026, for a memcached timing side-channel flaw fixed upstream in version 1.6.42 and reflected in Microsoft’s Azure Linux 3.0 package update from azl3 memcached 1.6.27-4 to 1.6.27-5. The bug is not a Windows desktop crisis, and that is precisely why...

CVE-2025-13912 is a timing‑side‑channel concern in wolfSSL where compiler optimizations (notably from Clang/LLVM toolchains) can transform carefully written constant‑time C code into binaries whose runtime varies with secret data — a behavior that undermines cryptographic assumptions and was...

The TLS 1.3 pre-shared key (PSK) binder verification in wolfSSL contained a timing side‑channel: a non‑constant‑time comparison allowed tiny timing differences during binder verification that could, in theory, leak information about a PSK binder. The issue was assigned CVE‑2025‑11932, publicly...

A subtle timing weakness in X25519 implementations that affects Xtensa-based ESP32 chips has been logged as CVE-2025-12888, and wolfSSL—one of the mainstream embedded crypto libraries—has already shipped a targeted mitigation that changes build defaults for Xtensa targets to safer, low‑memory...