CVE-2025-59432

Name of the Vulnerable Software and Affected Versions versions prior to 3.2

Description A timing attack issue exists in the SCRAM Java implementation due to the use of Arrays.equals for comparing sensitive values like client proofs and server signatures. Arrays.equals performs a short-circuit comparison, causing variable execution times based on the number of matching leading bytes. This could allow an attacker to perform a timing side-channel attack and potentially reveal authentication information. The issue impacts all users relying on SCRAM authentication. The vulnerable function is Arrays.equals.

Recommendations Upgrade to version 3.2 or later to mitigate this issue.