[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-56764":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":78,"aliases":79,"duplicate_of":9,"upstream":82,"downstream":83,"duplicates":86,"related":87,"reserved_at":9,"published_at":90,"modified_at":91,"state":92,"summary":93,"references_raw":102,"kevs":169,"epss":170,"epss_history":173,"metrics":370,"affected":388},"CVE-2026-56764","Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-208","Observable Timing Discrepancy","Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.","weakness","Incomplete","Base",[19,23,35],{"id":20,"name":21,"techniques":22},"CAPEC-462","Cross-Domain Search Timing",[],{"id":24,"name":25,"techniques":26},"CAPEC-541","Application Fingerprinting",[27],{"id":28,"name":29,"tactics":30,"countermeasures":34},"T1592.002","Software",[31],{"id":32,"name":33},"TA0043","Reconnaissance",[],{"id":36,"name":37,"techniques":38},"CAPEC-580","System Footprinting",[39],{"id":40,"name":41,"tactics":42,"countermeasures":46},"T1082","System Information Discovery",[43],{"id":44,"name":45},"TA0102","Discovery",[47,52,57,61,66,70,74],{"id":48,"name":49,"tactic":50},"D3-DE","Decoy Environment",{"name":51},"Deceive",{"id":53,"name":54,"tactic":55},"D3-EAL","Executable Allowlisting",{"name":56},"Isolate",{"id":58,"name":59,"tactic":60},"D3-HBPI","Hardware-based Process Isolation",{"name":56},{"id":62,"name":63,"tactic":64},"D3-PSA","Process Spawn Analysis",{"name":65},"Detect",{"id":67,"name":68,"tactic":69},"D3-SCF","System Call Filtering",{"name":56},{"id":71,"name":72,"tactic":73},"D3-EDL","Executable Denylisting",{"name":56},{"id":75,"name":76,"tactic":77},"D3-SCA","System Call Analysis",{"name":65},[],[80,81],"GHSA-gq3j-xvxp-8hrf","RHSA-2026:47618",[],[84],{"_key":85},"RHSA-2026:47619",[],[88],{"_key":89},"CGA-G64J-4J99-8GC7","2026-07-15T11:25:32.814Z","2026-07-15T13:50:24.700Z","Deferred",{"cisa_kev":94,"cisa_ransomware":94,"cisa_vendor":9,"epss_severity":95,"epss_score":96,"severity":97,"severity_score":98,"severity_version":99,"severity_source":100,"severity_vector":101,"severity_status":92},false,"low",0.00297,"medium",6.3,"v4.0","cve.org","CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",[103,113,118,122,127,131,136,140,145,149,153,157,161,165],{"url":104,"sources":105,"tags":109},"https://github.com/honojs/hono/security/advisories/GHSA-gq3j-xvxp-8hrf",[100,106,107,108],"osv_npm","nvd","osv_red_hat",[110,111,112],"Vendor Advisory","WEB","ARTICLE",{"url":114,"sources":115,"tags":116},"https://www.vulncheck.com/advisories/hono-timing-attack-in-basicauth-and-bearerauth-middleware",[100,107,108],[117,112],"Third Party Advisory",{"url":119,"sources":120,"tags":121},"https://github.com/honojs/hono/commit/91def7cab654bad5eecc9270e6620d577971ff5e",[106],[111],{"url":123,"sources":124,"tags":125},"https://github.com/honojs/hono",[106],[126],"PACKAGE",{"url":128,"sources":129,"tags":130},"https://github.com/honojs/hono/releases/tag/v4.11.10",[106],[111],{"url":132,"sources":133,"tags":134},"https://access.redhat.com/errata/RHSA-2026:47618",[108],[135],"Advisory",{"url":137,"sources":138,"tags":139},"https://images.redhat.com/",[108],[112],{"url":141,"sources":142,"tags":143},"https://access.redhat.com/security/cve/CVE-2026-56764",[108],[144],"REPORT",{"url":146,"sources":147,"tags":148},"https://access.redhat.com/security/updates/classification/",[108],[112],{"url":150,"sources":151,"tags":152},"https://access.redhat.com/security/cve/CVE-2026-42127",[108],[112],{"url":154,"sources":155,"tags":156},"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47618.json",[108],[135],{"url":158,"sources":159,"tags":160},"https://bugzilla.redhat.com/show_bug.cgi?id=2500893",[108],[144],{"url":162,"sources":163,"tags":164},"https://www.cve.org/CVERecord?id=CVE-2026-56764",[108],[135],{"url":166,"sources":167,"tags":168},"https://nvd.nist.gov/vuln/detail/CVE-2026-56764",[108],[135],[],{"date":171,"score":96,"percentile":172},"2026-09-19",0.22557,[174,178,181,184,187,190,193,196,199,202,205,208,211,214,217,220,223,226,229,232,235,238,241,244,247,250,253,256,259,262,265,268,271,274,277,280,283,286,289,292,295,298,301,304,307,310,313,316,318,321,324,327,330,333,336,339,342,345,348,351,354,357,360,363,366,369],{"date":175,"score":176,"percentile":177},"2026-07-16",0.00229,0.13707,{"date":179,"score":176,"percentile":180},"2026-07-17",0.13713,{"date":182,"score":176,"percentile":183},"2026-07-18",0.13708,{"date":185,"score":176,"percentile":186},"2026-07-19",0.13704,{"date":188,"score":176,"percentile":189},"2026-07-20",0.13805,{"date":191,"score":176,"percentile":192},"2026-07-21",0.13787,{"date":194,"score":176,"percentile":195},"2026-07-22",0.13826,{"date":197,"score":176,"percentile":198},"2026-07-23",0.13808,{"date":200,"score":176,"percentile":201},"2026-07-24",0.1381,{"date":203,"score":176,"percentile":204},"2026-07-25",0.13887,{"date":206,"score":176,"percentile":207},"2026-07-26",0.13877,{"date":209,"score":176,"percentile":210},"2026-07-27",0.13849,{"date":212,"score":176,"percentile":213},"2026-07-28",0.13893,{"date":215,"score":176,"percentile":216},"2026-07-29",0.13879,{"date":218,"score":176,"percentile":219},"2026-07-30",0.13874,{"date":221,"score":176,"percentile":222},"2026-07-31",0.13872,{"date":224,"score":176,"percentile":225},"2026-08-01",0.13861,{"date":227,"score":176,"percentile":228},"2026-08-02",0.13859,{"date":230,"score":176,"percentile":231},"2026-08-03",0.13866,{"date":233,"score":176,"percentile":234},"2026-08-04",0.13822,{"date":236,"score":176,"percentile":237},"2026-08-05",0.13767,{"date":239,"score":176,"percentile":240},"2026-08-06",0.1376,{"date":242,"score":176,"percentile":243},"2026-08-07",0.13742,{"date":245,"score":176,"percentile":246},"2026-08-08",0.13733,{"date":248,"score":176,"percentile":249},"2026-08-09",0.13712,{"date":251,"score":176,"percentile":252},"2026-08-10",0.13722,{"date":254,"score":176,"percentile":255},"2026-08-11",0.13806,{"date":257,"score":176,"percentile":258},"2026-08-12",0.13831,{"date":260,"score":176,"percentile":261},"2026-08-13",0.13833,{"date":263,"score":176,"percentile":264},"2026-08-14",0.13837,{"date":266,"score":176,"percentile":267},"2026-08-15",0.13993,{"date":269,"score":176,"percentile":270},"2026-08-16",0.14016,{"date":272,"score":176,"percentile":273},"2026-08-17",0.13942,{"date":275,"score":176,"percentile":276},"2026-08-18",0.13947,{"date":278,"score":176,"percentile":279},"2026-08-19",0.1399,{"date":281,"score":176,"percentile":282},"2026-08-20",0.14002,{"date":284,"score":176,"percentile":285},"2026-08-21",0.14005,{"date":287,"score":176,"percentile":288},"2026-08-22",0.14003,{"date":290,"score":176,"percentile":291},"2026-08-23",0.1401,{"date":293,"score":96,"percentile":294},"2026-08-24",0.21661,{"date":296,"score":96,"percentile":297},"2026-08-25",0.21679,{"date":299,"score":96,"percentile":300},"2026-08-26",0.21749,{"date":302,"score":96,"percentile":303},"2026-08-27",0.21754,{"date":305,"score":96,"percentile":306},"2026-08-28",0.21762,{"date":308,"score":96,"percentile":309},"2026-08-29",0.21785,{"date":311,"score":96,"percentile":312},"2026-08-30",0.21826,{"date":314,"score":96,"percentile":315},"2026-08-31",0.21799,{"date":317,"score":96,"percentile":312},"2026-09-01",{"date":319,"score":96,"percentile":320},"2026-09-02",0.21851,{"date":322,"score":96,"percentile":323},"2026-09-03",0.21869,{"date":325,"score":96,"percentile":326},"2026-09-04",0.21896,{"date":328,"score":96,"percentile":329},"2026-09-05",0.21924,{"date":331,"score":96,"percentile":332},"2026-09-06",0.21966,{"date":334,"score":96,"percentile":335},"2026-09-07",0.21971,{"date":337,"score":96,"percentile":338},"2026-09-08",0.21984,{"date":340,"score":96,"percentile":341},"2026-09-09",0.22111,{"date":343,"score":96,"percentile":344},"2026-09-10",0.22117,{"date":346,"score":96,"percentile":347},"2026-09-11",0.22109,{"date":349,"score":96,"percentile":350},"2026-09-12",0.22216,{"date":352,"score":96,"percentile":353},"2026-09-13",0.22173,{"date":355,"score":96,"percentile":356},"2026-09-14",0.22196,{"date":358,"score":96,"percentile":359},"2026-09-15",0.22268,{"date":361,"score":96,"percentile":362},"2026-09-16",0.22355,{"date":364,"score":96,"percentile":365},"2026-09-17",0.22406,{"date":367,"score":96,"percentile":368},"2026-09-18",0.22551,{"date":171,"score":96,"percentile":172},[371,380,382,386],{"source":100,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":372,"cvss_v4_0":378},{"baseScore":373,"baseSeverity":374,"vectorString":375,"impactScore":376,"exploitabilityScore":377},3.7,"LOW","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",2.3,5.6,{"baseScore":98,"baseSeverity":379,"vectorString":101,"impactScore":9,"exploitabilityScore":9},"MEDIUM",{"source":106,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":381,"cvss_v4_0":9},{"baseScore":373,"baseSeverity":9,"vectorString":375,"impactScore":376,"exploitabilityScore":377},{"source":107,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":383,"cvss_v4_0":384},{"baseScore":373,"baseSeverity":374,"vectorString":375,"impactScore":376,"exploitabilityScore":377},{"baseScore":98,"baseSeverity":379,"vectorString":385,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",{"source":108,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":387,"cvss_v4_0":9},{"baseScore":373,"baseSeverity":9,"vectorString":375,"impactScore":376,"exploitabilityScore":377},[389,398,405],{"ecosystem":9,"name":390,"vendor":390,"product":390,"cpe_part":391,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":392},"hono","a",[393],{"version":394,"is_range":395,"range_type":100,"version_start":9,"version_start_type":9,"version_end":396,"version_end_type":397,"fixed_in":9},"\u003C 4.11.10",true,"4.11.10","excluding",{"ecosystem":399,"name":390,"vendor":399,"product":390,"cpe_part":9,"purl_type":400,"purl_namespace":9,"purl_name":390,"source":9,"versions":401},"Npm","npm",[402],{"version":403,"is_range":395,"range_type":404,"version_start":9,"version_start_type":9,"version_end":396,"version_end_type":397,"fixed_in":9},"lt4_11_10","semver",{"ecosystem":406,"name":407,"vendor":408,"product":407,"cpe_part":9,"purl_type":409,"purl_namespace":408,"purl_name":407,"source":9,"versions":410},"Red Hat","grafana13.1","redhat","rpm",[411],{"version":412,"is_range":395,"range_type":413,"version_start":9,"version_start_type":9,"version_end":414,"version_end_type":397,"fixed_in":9},"lt0:13_1_1_0_2_hum1","ecosystem","0:13.1.1-0.2.hum1"]