CVE-2024-13939

EUVD-2025-8542
String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.

As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)."

This is similar to CVE-2020-36829
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 53%
Affected Products (NVD)
VendorProductVersion
fractalstring\
𝑥
≤ 0.321
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libstring-compare-constanttime-perl
bookworm
no-dsa
bullseye
postponed
forky
0.321-3
fixed
sid
0.321-3
fixed
trixie
0.321-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libstring-compare-constanttime-perl
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
xenial
needs-triage