Timing Attack Vulnerability in SCRAM Authentication
Impact
A timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted.
Patches
This vulnerability has been patched by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.
Users should upgrade to version 3.2 or later to mitigate this issue.
Workarounds
Because the attack requires high precision and repeated attempts, the risk is limited, but the only reliable mitigation is to upgrade to a patched release (version 3.2 or later).
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | com.ongres.scram:scram-common | < 3.2 | 3.2 |
References
- https://github.com/ongres/scram/security/advisories/GHSA-3wfh-36rx-9537
- https://nvd.nist.gov/vuln/detail/CVE-2025-59432
- https://github.com/ongres/scram/commit/e0b0cf99f05406a0d26682c72fcb5728e95124b3
- https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte%5B%5D,byte%5B%5D)
- https://github.com/ongres/scram
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U- Weakness (CWE)
CWE-208, CWE-385- Platform
- Java / Kotlin (Maven)
- Package
com.ongres.scram:scram-common- Disclosed
- 16.09.2025
- Updated
- 11.10.2026 12:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-3wfh-36rx-9537 - CC BY 4.0
Vulnerability history: com.ongres.scram:scram-common
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 09.2025 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 1
Disclosures per year
- 2025: 1
- 2026: 1
-
Timing Attack Vulnerability in SCRAM Authentication this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.