CVE-2026-74846
Description
A flaw was found in Catalyst::Plugin::Authentication. The legacy password verification mechanism performs non-constant-time string comparisons when checking passwords and cryptographic hashes. A remote attacker can exploit this timing discrepancy by measuring response-time differences to incrementally deduce stored credentials, leading to information disclosure.
Statement
This vulnerability is rated with Moderate impact because exploiting the timing discrepancy remotely requires high attack complexity, including minimal network latency variance and extensive statistical sampling. Furthermore, the issue is confined to applications utilizing deprecated legacy authentication routines rather than standard realm-based verifiers. Supported Red Hat Enterprise Linux releases do not ship this package, significantly reducing exposure across default enterprise environments.
Understanding the Weakness (CWE)
Confidentiality,Access Control
Technical Impact: Read Application Data; Bypass Protection Mechanism
In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations. For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess. Timing discrepancies effectively form a timing side channel.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
