Timing Attack Vulnerability in httpsig-rs by Junku Rihara

CVE-2025-59058

What is CVE-2025-59058?

The httpsig-rs library, a Rust implementation of the IETF RFC 9421 for HTTP message signatures, is susceptible to a timing attack due to non-timing-safe HMAC signature comparison in versions prior to 0.0.19. This vulnerability enables attackers to exploit HS256 signature verification, allowing for potential signature forgery. Users of this library are strongly encouraged to upgrade to version 0.0.19 or later to mitigate this security issue effectively. For further details, refer to the provided security advisory and commit notes.

References