---
id: "CVE-2026-58803"
page: "https://infrastack.ai/live/CVE-2026-58803"
kind: "vulnerability"
aliases: ["CVE-2026-58803"]
title: "Rust bytes_are_equal leaks timing data that can reveal authentication keys"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "rust"]
not_affected_if: []
published_at: "2026-11-10T20:19:27+00:00"
first_seen_at: "2026-11-10T20:46:11+00:00"
updated_at: "2026-11-10T20:51:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58803", "first_seen_at": "2026-11-10T20:46:11+00:00"}]
exploit_sources: []
---

# Rust bytes_are_equal leaks timing data that can reveal authentication keys

Link for people: https://infrastack.ai/live/CVE-2026-58803 (this .md is for agents)

A comparison function named bytes_are_equal in a Rust library file lib.rs leaks side-channel information. A local attacker may use that leak to recover authentication keys.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58803

## From the sources

In bytes_are_equal of lib.rs, there is a possible way to recover authentication keys due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_