Skip to content
Heist/ feed
Back to feed
High

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string

Type: advisorySources: OSV

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)." This is similar to CVE-2020-36829

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2024-13939
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 03:34 UTC · Revision 1

Source evidence

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string

core-osv · Original source

Published 28 Mar 2025, 02:05 UTC

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)." This is similar to CVE-2020-36829

osv:CVE-2024-13939
Complete source record
{
  "id": "95fa7d7922310ba88a2d481b6dab2bf76e0625021b885a31bfc663c6ba652a6d",
  "url": "https://osv.dev/vulnerability/CVE-2024-13939",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string",
    "summary": "String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: \"If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents).\" This is similar to CVE-2020-36829",
    "evidence": "osv:CVE-2024-13939",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2024-13939",
      "aliases": [
        "CVE-2024-13939"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/hoytech/string-compare-constanttime",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "51d7d7832bc45523fb97447d137a54d5b2fe949e"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "0.321"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "cpe": "cpe:2.3:a:fractal:string\\:\\:compare\\:\\:constanttime:*:*:*:*:*:perl:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "0.321"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "String-Compare-ConstantTime-0.321",
            "String-Compare-ConstantTime-0.320",
            "String-Compare-ConstantTime-0.312",
            "String-Compare-ConstantTime-0.311",
            "String-Compare-ConstantTime-0.310",
            "String-Compare-ConstantTime-0.300",
            "String-Compare-ConstantTime-0.20"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13939.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.713570117Z",
      "provider": "osv",
      "references": [
        "https://cpan.org/modules",
        "https://metacpan.org/release/FRACTAL/String-Compare-ConstantTime-0.321/view/lib/String/Compare/ConstantTime.pm#TIMING-SIDE-CHANNEL",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13939.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-13939",
        "https://github.com/hoytech/String-Compare-ConstantTime"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-208"
        ],
        "cna_assigner": "CPANSec",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13939.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-13939",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 500054,
  "published_at": "2025-03-28T02:05:01.416+00:00"
}