{
  "cveId": "CVE-2024-13939",
  "url": "https://patchblox.com/security/cve/CVE-2024-13939",
  "summary": "CVE-2024-13939 is fixed in libstring-compare-constanttime-perl on 1 platform, first by DEBIAN-CVE-2024-13939, released March 28, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "libstring-compare-constanttime-perl: String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess...",
  "description": "String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.  As stated in the documentation: \u0022If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents).\u0022  This is similar to\u00A0CVE-2020-36829",
  "published": "2025-03-28T03:15:15Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss": 0.00374,
  "epssPercentile": 0.31576,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libstring-compare-constanttime-perl",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "0.321-3",
      "fix": "DEBIAN-CVE-2024-13939",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-13939",
      "released": "2025-03-28T03:15:15Z"
    },
    {
      "platform": "linux",
      "product": "libstring-compare-constanttime-perl",
      "release": "Debian 14",
      "fixedVersion": "0.321-3",
      "fix": "DEBIAN-CVE-2024-13939",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-13939",
      "released": "2025-03-28T03:15:15Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}