## cve-2026-59276 - MEDIUM - Timing Attack via Non-Constant-Time Comparison of Sensitive Values

- 種別: advisory
- 関連技術: spring, java
- CVE: CVE-2026-59276
- 公開日時: 2026-08-20T00:00:00.000Z
- 情報源: Spring Security Advisories (https://spring.io/security/cve-2026-59276)
- パーマリンク: https://vulnpulse.app/items/spring-security-361320f01e18

Several components in Spring Security compare security-sensitive values using standard string equality ( String.equals() ) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. An attacker capable of submitting a very large number of guesses and precisely measuring response latency could, in principle, use these timing differences to recover the expected value one character at a time. The affected comparison…