timingattack

The timingattack tag covers discussions about side-channel vulnerabilities that exploit measurable differences in execution time to leak sensitive information. Content includes CVE-2026-47784 in memcached, where a non-constant-time memcmp in SASL authentication creates a timing side channel, and CVE-2025-40204 in Linux SCTP, where a timing-dependent MAC comparison was replaced with a constant-time helper. A third thread describes coordinated RDP scans using timing-based username enumeration against education sector networks. These examples highlight how timing attacks affect both open-source components in Windows estates and Windows Remote Desktop services, emphasizing the need for constant-time comparisons and monitoring for timing-based reconnaissance.