Vulnerability · Published Sep 22, 2025 · Assigned by GitHub_M

CVE-2025-59432Timing Attack Vulnerability in SCRAM Authentication

Medium 6.6

In plain English

A medium-severity security flaw in scram from ongres. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.6Medium

Exploit odds (30 days)0.7%top 46.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libscram-java	no fix listed	DEBIAN-CVE-2025-59432
Debian:13	libscram-java	no fix listed	DEBIAN-CVE-2025-59432
Debian:14	libscram-java	3.2-1	DEBIAN-CVE-2025-59432
Maven	com.ongres.scram:scram-common	3.2	GHSA-3wfh-36rx-9537
Ubuntu:22.04:LTS	scram	no fix listed	UBUNTU-CVE-2025-59432
Ubuntu:24.04:LTS	scram	no fix listed	UBUNTU-CVE-2025-59432

Affected products (as reported)

Vendor	Product	Versions
ongres	scram	< 3.2

Weakness: CWE-208, CWE-385 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

References

https://github.com/ongres/scram/security/advisories/GHSA-3wfh-36rx-9537 x_refsource_CONFIRM
https://github.com/ongres/scram/commit/e0b0cf99f05406a0d26682c72fcb5728e95124b3 x_refsource_MISC
https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte%5B%5D,byte%5B%5D) x_refsource_MISC