{"action":"Upgrade richie to 3.3.0 or later.","affected":[{"fixed":"3.3.0","introduced":"0"}],"component":"richie","cve_ids":["CVE-2026-26717"],"ecosystem":"PyPI","epss":0.00568,"exploited":false,"fixed_versions":["3.3.0"],"ghsa_id":"GHSA-xjhr-fm27-4hmx","id":"tcs_01M5KH34WVE6JDGR7AH0STGZDW","modified_at":"2026-07-13T16:32:44.015583598Z","published_at":"2026-07-13T14:36:38.520323Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3052","https://nvd.nist.gov/vuln/detail/CVE-2026-26717","https://github.com/openfun/richie/commit/a1b5bbda3403d7debb466c303a32852925fcba5f","https://github.com/Rickidevs/CVE-2026-26717","https://github.com/openfun/richie","https://medium.com/@ordogh/cve-2026-26717-hmac-timing-attack-in-openfun-richie-lms-f04377efe83d?postPublishedType=repub","https://pypi.org/project/richie","https://github.com/advisories/GHSA-xjhr-fm27-4hmx"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-3052","url":"https://osv.dev/vulnerability/PYSEC-2026-3052"}],"summary":"OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function"}