Low severity3.7NVD Advisory· Published Sep 3, 2016· Updated Jun 17, 2026

CVE-2016-5429

Description

jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Jose PHP Project/Jose PHP
cpe:2.3:a:jose-php_project:jose-php:*:*:*:*:*:*:*:*
Range: <=2.2.0
Nov/jose-phpllm-fuzzy
Range: <2.2.1

Patches

Vulnerability mechanics

References

github.com/nov/jose-php/commit/1cce55e27adf0274193eb1cd74b927a398a3df4bnvdPatch
github.com/nov/jose-php/commit/f03b986b4439e20b0fd635109b48afe96cf0099bnvdPatch
www.securityfocus.com/bid/92743nvdThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.240
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000