CWE · MITRE source
CWE-208Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations. For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess. Timing discrepancies effectively form a timing side channel.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: full · 7 mapping(s) from 3 framework(s): CAPEC 3 (partial) · ATT&CK 3 (partial) · ASVS 5.0 1 (full)
NIST 800-53 r5 controls that address this weakness (2)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-30 | Concealment and Misdirection | SC | Timing randomization or delays can mask true operation timing and mislead timing-based attacks. |
SC-31 | Covert Channel Analysis | SC | Observable timing discrepancies are a primary mechanism for constructing covert timing channels; analysis identifies and bounds them, limiting exploitation. |
MITRE ATT&CK techniques this weakness enables
Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial).
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2021-43298 | 7.0 | 9.8 | 0.0226 | 2022-01-25 |
CVE-2023-41313 | 7.0 | 9.8 | 0.0101 | 2024-03-12 |
CVE-2026-23519 | 7.0 | 9.8 | 0.0050 | 2026-01-15 |
CVE-2026-41588 UPD | 7.0 | 9.0 | 0.0036 | 2026-05-08 |
CVE-2021-42016 | 5.5 | 7.5 | 0.0060 | 2022-03-08 |
CVE-2022-31142 | 5.5 | 7.5 | 0.0116 | 2022-07-14 |
CVE-2023-25529 | 5.5 | 8.0 | 0.0052 | 2023-09-20 |
CVE-2024-23342 UPD | 5.5 | 7.4 | 0.0098 | 2024-01-23 |
CVE-2024-29995 | 5.5 | 8.1 | 0.0146 | 2024-08-13 |
CVE-2024-42512 | 5.5 | 8.6 | 0.0055 | 2025-02-10 |
CVE-2024-13939 | 5.5 | 7.5 | 0.0034 | 2025-03-28 |
CVE-2025-68621 | 5.5 | 7.4 | 0.0051 | 2026-02-06 |
CVE-2025-48630 | 5.5 | 7.4 | 0.0009 | 2026-03-02 |
CVE-2025-70949 | 5.5 | 7.5 | 0.0038 | 2026-03-05 |
CVE-2026-27856 UPD | 5.5 | 7.4 | 0.0039 | 2026-03-27 |
CVE-2026-5086 | 5.5 | 7.5 | 0.0040 | 2026-04-13 |
CVE-2026-40972 | 5.5 | 7.5 | 0.0026 | 2026-04-28 |
CVE-2026-42602 UPD | 5.5 | 8.1 | 0.0022 | 2026-05-13 |
CVE-2026-47783 UPD | 5.5 | 8.1 | 0.0131 | 2026-05-20 |
CVE-2026-47784 UPD | 5.5 | 8.1 | 0.0055 | 2026-05-20 |
CVE-2026-47373 UPD | 5.5 | 7.5 | 0.0039 | 2026-05-20 |
CVE-2016-10535 | 3.5 | 5.9 | 0.0130 | 2018-05-31 |
CVE-2019-9494 | 3.5 | 5.9 | 0.0374 | 2019-04-17 |
CVE-2019-13420 | 3.5 | 5.9 | 0.0119 | 2019-08-13 |
CVE-2019-16782 | 3.5 | 6.3 | 0.0369 | 2019-12-18 |