CVE-2025-59058: httpsig-rs Auth Bypass Vulnerability

CVE-2025-59058 Overview

CVE-2025-59058 is a timing attack vulnerability in httpsig-rs, a Rust implementation of IETF RFC 9421 HTTP Message Signatures. The library performed HMAC signature comparison using non-constant-time equality checks in versions prior to 0.0.19. Applications relying on HS256 signature verification are exposed to timing side-channel analysis. An attacker can measure verification response times to iteratively recover a valid MAC and forge signed HTTP messages. The maintainer released version 0.0.19 to address the flaw. This weakness is tracked under [CWE-208: Observable Timing Discrepancy].

Critical Impact
Attackers on the network can forge valid HMAC-SHA256 signatures by exploiting timing differences in signature comparison, undermining the integrity guarantees of RFC 9421 HTTP message signing.

Affected Products

httpsig-rs crate versions prior to 0.0.19
Rust applications using httpsig-rs HS256 signature verification
Downstream services relying on httpsig-rs for RFC 9421 HTTP message integrity

Discovery Timeline

2025-09-12 - CVE-2025-59058 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59058

Vulnerability Analysis

The vulnerability resides in the verify implementation for SharedKey in httpsig/src/crypto/symmetric.rs. The verification routine computed the expected MAC using self.sign(data) and then compared it to the attacker-supplied expected_mac with the standard == operator. Rust's default byte slice equality short-circuits at the first differing byte. That behavior leaks information about how many leading bytes of a candidate MAC match the correct value.

An attacker who can submit many signed requests and measure response latency can perform a byte-by-byte oracle attack. Each additional matching byte extends the comparison and produces a measurable delay. By iterating over 256 candidate values per byte position, the attacker can reconstruct a valid 32-byte HMAC-SHA256 tag without knowing the shared key. Once recovered, the attacker forges signatures on arbitrary HTTP messages that pass RFC 9421 verification.

Root Cause

The root cause is the absence of a constant-time comparison for cryptographic MAC values. The original code used a variable-time equality check between the computed MAC and the caller-provided MAC, violating the standard requirement that authentication tag comparisons must not leak timing information.

Attack Vector

Exploitation requires network access to a service that verifies HS256 HTTP message signatures using httpsig-rs. No authentication or user interaction is required. The attacker submits crafted HTTP requests with candidate signatures and measures verification response times. High attack complexity reflects the need for statistical timing analysis across many requests to overcome network jitter.

rust

// Patch: httpsig/src/crypto/symmetric.rs
 impl super::VerifyingKey for SharedKey {
   /// Verify the mac
   fn verify(&self, data: &[u8], expected_mac: &[u8]) -> HttpSigResult<()> {
-    use super::SigningKey;
-    debug!("Verify HmacSha256");
-    let calcurated_mac = self.sign(data)?;
-    if calcurated_mac == expected_mac {
-      Ok(())
-    } else {
-      Err(HttpSigError::InvalidSignature("Invalid MAC".to_string()))
+    match self {
+      SharedKey::HmacSha256(key) => {
+        debug!("Verify HmacSha256");
+        let mut mac = HmacSha256::new_from_slice(key).unwrap();
+        mac.update(data);
+        mac.verify_slice(expected_mac)
+          .map_err(|_| HttpSigError::InvalidSignature("Invalid MAC".to_string()))
+      }
+    }
   }
// Source: https://github.com/junkurihara/httpsig-rs/commit/fc095b6ce6043bb808f5d9c4379cf697899cb458

The fix replaces the variable-time == comparison with Hmac::verify_slice, which internally uses a constant-time comparator from the subtle crate.

Detection Methods for CVE-2025-59058

Indicators of Compromise

Repeated HTTP requests from a single source targeting a signed endpoint with slight variations in the Signature header
Elevated volume of Invalid MAC verification failures preceding a successful request
Unusual clustering of requests with identical Signature-Input parameters but differing signature bytes

Detection Strategies

Enumerate all Rust services in the software bill of materials and flag any dependency on httpsig-rs prior to 0.0.19
Instrument signature verification code paths to log failure counts per source IP and per session
Alert when a client generates a burst of signature verification failures followed by an authenticated success within a short window

Monitoring Recommendations

Aggregate verification failure metrics in a SIEM and baseline normal failure rates per endpoint
Monitor request latency distributions on signed endpoints for statistically abnormal probing patterns
Track version drift of the httpsig-rs crate across build pipelines and container images

How to Mitigate CVE-2025-59058

Immediate Actions Required

Upgrade httpsig-rs to version 0.0.19 or later in all Cargo.toml manifests and rebuild affected services
Audit application code for other custom MAC or token comparisons using == and replace them with constant-time equivalents
Rotate any HS256 shared keys that may have been exposed to prolonged probing by untrusted clients

Patch Information

The fix is delivered in httpsig-rs version 0.0.19 via commit fc095b6ce6043bb808f5d9c4379cf697899cb458. It replaces the variable-time comparison with HmacSha256::verify_slice, which performs a constant-time check. See the GitHub Security Advisory GHSA-q7pg-9pr4-mrp2 and the upstream patch commit for details.

Workarounds

Apply strict rate limiting on endpoints that verify HTTP message signatures to slow timing oracle attacks
Reject repeated invalid signature attempts from the same client and temporarily block offending sources
Front the service with a proxy that adds randomized response delays to mask timing differences until the patch is applied

bash

# Update the crate in Cargo.toml and refresh the lockfile
cargo update -p httpsig --precise 0.0.19
cargo tree -i httpsig    # confirm no transitive dependency pins an older version
cargo build --release