{"id":"CVE-2026-58803","kind":"vulnerability","aliases":["CVE-2026-58803"],"related":[],"title":"Rust bytes_are_equal leaks timing data that can reveal authentication keys","description":"In bytes_are_equal of lib.rs, there is a possible way to recover authentication keys due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A comparison function named bytes_are_equal in a Rust library file lib.rs leaks side-channel information. A local attacker may use that leak to recover authentication keys.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","rust"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:27+00:00","first_seen_at":"2026-11-10T20:46:11+00:00","triaged_at":"2026-11-10T20:51:32+00:00","updated_at":"2026-11-10T20:51:32+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T20:51:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Rust bytes_are_equal leaks timing data that can reveal authentication keys","impact":"high","summary":"A comparison function named bytes_are_equal in a Rust library file lib.rs leaks side-channel information. A local attacker may use that leak to recover authentication keys.","audience":"developers","category":"other","nicknames":[],"who_cares":["rust"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local attacker recovers authentication keys through side channel","analyst_note":"Identify the crate and versions containing bytes_are_equal in lib.rs and any fixed release, from the NVD entry or upstream advisory.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected crate or version. Teams that use a Rust library with a bytes_are_equal function for key or token comparison should check their dependencies. The sources do not say which systems are exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000652,"input_tokens":4523,"output_tokens":400,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-58803':15A,18A 'addit':80C 'attack':41B 'authent':11A,48B,63C 'byte':2A,25B,51C 'channel':37B,68C 'comparison':22B 'could':72C 'cve':13A,16A 'data':7A 'disclosur':70C,77C 'due':65C 'equal':4A,27B,53C 'execut':81C 'exploit':90C 'file':32B 'function':23B 'inform':38B,69C,76C 'interact':85C 'key':12A,49B,64C 'lead':73C 'leak':5A,34B,45B 'lib.rs':33B,55C 'librari':31B 'local':40B,75C 'may':42B 'name':24B 'need':83C,88C 'possibl':59C 'privileg':82C 'recov':47B,62C 'reveal':10A 'rust':1A,20B,30B 'side':36B,67C 'side-channel':35B 'time':6A 'use':43B 'user':84C 'way':60C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected crate or version. Teams that use a Rust library with a bytes_are_equal function for key or token comparison should check their dependencies. The sources do not say which systems are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["other","rust","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-58803':15A,18A 'authent':11A 'byte':2A 'cve':13A,16A 'data':7A 'equal':4A 'key':12A 'leak':5A 'reveal':10A 'rust':1A 'time':6A","search_b":"'attack':41B 'authent':48B 'byte':25B 'channel':37B 'comparison':22B 'equal':27B 'file':32B 'function':23B 'inform':38B 'key':49B 'leak':34B,45B 'lib.rs':33B 'librari':31B 'local':40B 'may':42B 'name':24B 'recov':47B 'rust':20B,30B 'side':36B 'side-channel':35B 'use':43B","search_c":"'addit':80C 'authent':63C 'byte':51C 'channel':68C 'could':72C 'disclosur':70C,77C 'due':65C 'equal':53C 'execut':81C 'exploit':90C 'inform':69C,76C 'interact':85C 'key':64C 'lead':73C 'lib.rs':55C 'local':75C 'need':83C,88C 'possibl':59C 'privileg':82C 'recov':62C 'side':67C 'user':84C 'way':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58803","severity":null,"published_at":"2026-11-10T20:19:27+00:00","modified_at":"2026-11-10T20:19:27+00:00","first_seen_at":"2026-11-10T20:46:11+00:00","fetched_at":"2026-11-10T20:46:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}