{"action":"Upgrade richie to 3.3.0 or later.","affected":[{"fixed":"3.3.0","introduced":"0"}],"component":"richie","cve_ids":["CVE-2026-26717"],"ecosystem":"PyPI","epss":0.0044,"exploited":false,"fixed_versions":["3.3.0"],"ghsa_id":"GHSA-xjhr-fm27-4hmx","id":"tcs_01M5KG4ANF3ZBCMPWP3K42VJZG","modified_at":"2026-09-10T03:50:36.343231578Z","published_at":"2026-02-25T18:31:38Z","references":["https://osv.dev/vulnerability/GHSA-xjhr-fm27-4hmx","https://nvd.nist.gov/vuln/detail/CVE-2026-26717","https://github.com/openfun/richie/commit/a1b5bbda3403d7debb466c303a32852925fcba5f","https://github.com/Rickidevs/CVE-2026-26717","https://github.com/openfun/richie","https://medium.com/@ordogh/cve-2026-26717-hmac-timing-attack-in-openfun-richie-lms-f04377efe83d?postPublishedType=repub"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-xjhr-fm27-4hmx","url":"https://osv.dev/vulnerability/GHSA-xjhr-fm27-4hmx"}],"summary":"OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function"}