CVE-2021-43398

Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks. NOTE: this report is disputed by the vendor and multiple third parties. The execution-time differences are intentional. A user may make a choice of a longer key as a tradeoff between strength and performance. In making this choice, the amount of information leaked to an adversary is of infinitesimal value

• CWE-203

• https://cryptopp.comVendor Advisory
• https://github.com/weidai11/cryptopp/issues/1080Exploit, Third Party Advisory
• https://github.com/weidai11/cryptopp/issues/1080#issuecomment-996492222Exploit, Issue Tracking, Third Party Advisory
• https://cryptopp.comVendor Advisory
• https://github.com/weidai11/cryptopp/issues/1080Exploit, Third Party Advisory
• https://github.com/weidai11/cryptopp/issues/1080#issuecomment-996492222Exploit, Issue Tracking, Third Party Advisory

Published

Nov 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43392STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN…6.2
• CVE-2021-43393STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN…6.2
• CVE-2021-43394Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC…9.8
• CVE-2021-43395An issue was discovered in illumos before f859e7171bb5db3432…5.5
• CVE-2021-43396In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc…7.5
• CVE-2021-43397LiquidFiles before 3.6.3 allows remote attackers to elevate …8.8
• CVE-2021-43399The Yubico YubiHSM YubiHSM2 library 2021.08, included in the…7.5
• CVE-2021-4340The uListing plugin for WordPress is vulnerable to generic S…7.5
• CVE-2021-43400An issue was discovered in gatt-database.c in BlueZ 5.61. A …9.1
• CVE-2021-43403An issue was discovered in FusionPBX before 4.5.30. The log_…6.5
• CVE-2021-43404An issue was discovered in FusionPBX before 4.5.30. The FAX …8.8
• CVE-2021-43405An issue was discovered in FusionPBX before 4.5.30. The fax_…8.8