{"action":"Upgrade httpsig to 0.0.19 or later.","affected":[{"fixed":"0.0.19","introduced":"0"}],"component":"httpsig","cve_ids":["CVE-2025-59058"],"ecosystem":"crates.io","epss":0.00283,"exploited":false,"fixed_versions":["0.0.19"],"ghsa_id":"GHSA-q7pg-9pr4-mrp2","id":"tcs_01M5KF2E8W1666QX6RS7A958MB","modified_at":"2025-09-12T22:13:24.081949Z","published_at":"2025-09-12T21:11:13Z","references":["https://osv.dev/vulnerability/GHSA-q7pg-9pr4-mrp2","https://github.com/junkurihara/httpsig-rs/security/advisories/GHSA-q7pg-9pr4-mrp2","https://nvd.nist.gov/vuln/detail/CVE-2025-59058","https://github.com/junkurihara/httpsig-rs/commit/fc095b6ce6043bb808f5d9c4379cf697899cb458","https://github.com/junkurihara/httpsig-rs"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-q7pg-9pr4-mrp2","url":"https://osv.dev/vulnerability/GHSA-q7pg-9pr4-mrp2"}],"summary":"httpsig-rs: HMAC verification is vulnerable to timing attack"}