CVE-2025-59432

MediumCVSS 6.6

Published: 22/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.70%

52th percentile - higher than 52% of all known CVEs

Summary

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the SASL authentication mechanisms. Prior to version 3.2, the Java implementation of SCRAM contains a timing attack vulnerability because Arrays.equals was used to compare values such as client proofs and server signatures, performing a short-circuit comparison. Differences in execution time could allow an attacker to infer sensitive authentication material.

Risk Assessment

An attacker could perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted.

Recommendation

Update the SCRAM library to version 3.1 or later, where Arrays.equals has been replaced with MessageDigest.isEqual ensuring constant-time comparison.

Other vulnerabilities in SCRAM

CVE-2026-53712High
A vulnerability in the SCRAM library allows an attacker performing a TLS man-in-the-middle attack to silently downgrade a connection from SCRAM-SHA-256-PLUS with channel binding to standard SCRAM-SHA-256 without channel binding. The issue occurs when TlsServerEndpoint processes an X.509 certificate using a modern signature algorithm such as Ed25519, and getChannelBindingData() can return an empty byte array after NoSuchAlgorithmException.

Original NVD description (English source)

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS