CVE-2021-43398
mediumpriority · track · 22EPSS 0.020 · 80 %ileEUUSEPSS · scored 2026-10-27
Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks. NOTE: this report is disputed by the vendor and multiple third parties. The execution-time differences are intentional. A user may make a choice of a longer key as a tradeoff between strength and performance. In making this choice, the amount of information leaked to an adversary is of infinitesimal value
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (9)
External citations — patches, advisories, analysis.
- https://cryptopp.comcnnvd
- https://github.com/weidai11/cryptopp/issues/1080#issuecomment-996492222cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-43398cnnvd
- https://cryptopp.comenisa_euvd
- https://github.com/weidai11/cryptopp/issues/1080enisa_euvd
- https://github.com/weidai11/cryptopp/issues/1080#issuecomment-996492222enisa_euvd
- https://cryptopp.comVendor Advisorynvd
- https://github.com/weidai11/cryptopp/issues/1080ExploitThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan