Timing Attack Vulnerability in httpsig-rs by Junku Rihara

CVE-2025-59058

What is CVE-2025-59058?

The httpsig-rs library, a Rust implementation of the IETF RFC 9421 for HTTP message signatures, is susceptible to a timing attack due to non-timing-safe HMAC signature comparison in versions prior to 0.0.19. This vulnerability enables attackers to exploit HS256 signature verification, allowing for potential signature forgery. Users of this library are strongly encouraged to upgrade to version 0.0.19 or later to mitigate this security issue effectively. For further details, refer to the provided security advisory and commit notes.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References