Posted by Daniel Owens via Fulldisclosure on Nov 01
Description
The Apache Struts2 Core 7.4.0 and below performs session token comparisons cryptographically insecure early-exit
comparison functions (e.g., `!=`, `memcmp`, byte-by-byte loops with `break`) that return as soon as the first
mismatched byte is encountered. The execution time of the comparison is therefore proportional to the number of
leading bytes that match, creating a measurable timing side-channel. Importantly, this…
Source: Full Disclosure (seclists.org) · 2026-11-02