CVE-2025-59058

@@ -4,7 +4,7 @@ resolver = "2"
 
 [workspace.package]
 edition = "2021"
-version = "0.0.18"
+version = "0.0.19"
 authors = ["Jun Kurihara"]
 homepage = "https://github.com/junkurihara/httpsig-rs"
 repository = "https://github.com/junkurihara/httpsig-rs"

@@ -13,12 +13,12 @@ rust-version.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-thiserror = { version = "2.0.11" }
+thiserror = { version = "2.0.16" }
 tracing = { version = "0.1.41" }
 rustc-hash = { version = "2.1.1" }
-indexmap = { version = "2.7.1" }
+indexmap = { version = "2.11.1" }
 fxhash = { version = "0.2.1" }
-rand = { version = "0.9.0" }
+rand = { version = "0.9.2" }
 
 # crypto
 pkcs8 = { version = "0.10.2", default-features = false, features = ["pem"] }
@@ -39,8 +39,8 @@ p384 = { version = "0.13.1", default-features = false, features = [
   "ecdsa",
 ] }
 hmac = { version = "0.12.1" }
-sha2 = { version = "0.10.8", default-features = false }
-bytes = { version = "1.10.0" }
+sha2 = { version = "0.10.9", default-features = false }
+bytes = { version = "1.10.1" }
 
 # encoding
 base64 = { version = "0.22.1" }

@@ -13,32 +13,32 @@ rust-version.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-httpsig = { path = "../httpsig", version = "0.0.18" }
+httpsig = { path = "../httpsig", version = "0.0.19" }
 
-thiserror = { version = "2.0.11" }
+thiserror = { version = "2.0.16" }
 tracing = { version = "0.1.41" }
 futures = { version = "0.3.31", default-features = false, features = [
   "std",
   "async-await",
 ] }
-indexmap = { version = "2.7.1" }
+indexmap = { version = "2.11.1" }
 
 # content digest with rfc8941 structured field values
-sha2 = { version = "0.10.8", default-features = false }
+sha2 = { version = "0.10.9", default-features = false }
 sfv = { version = "0.10.4" }
 
 # encoding
 base64 = { version = "0.22.1" }
 
 # for request and response headers
-http = { version = "1.2.0" }
+http = { version = "1.3.1" }
 http-body = { version = "1.0.1" }
-http-body-util = { version = "0.1.2" }
-bytes = { version = "1.10.0" }
+http-body-util = { version = "0.1.3" }
+bytes = { version = "1.10.1" }
 
 
 [dev-dependencies]
-tokio = { version = "1.43.0", default-features = false, features = [
+tokio = { version = "1.47.1", default-features = false, features = [
   "macros",
   "rt-multi-thread",
 ] } # testing only

@@ -53,13 +53,14 @@ impl super::SigningKey for SharedKey {
 impl super::VerifyingKey for SharedKey {
   /// Verify the mac
   fn verify(&self, data: &[u8], expected_mac: &[u8]) -> HttpSigResult<()> {
-    use super::SigningKey;
-    debug!("Verify HmacSha256");
-    let calcurated_mac = self.sign(data)?;
-    if calcurated_mac == expected_mac {
-      Ok(())
-    } else {
-      Err(HttpSigError::InvalidSignature("Invalid MAC".to_string()))
+    match self {
+      SharedKey::HmacSha256(key) => {
+        debug!("Verify HmacSha256");
+        let mut mac = HmacSha256::new_from_slice(key).unwrap();
+        mac.update(data);
+        mac.verify_slice(expected_mac)
+          .map_err(|_| HttpSigError::InvalidSignature("Invalid MAC".to_string()))
+      }
     }
   }