CWE · MITRE source
CWE-208Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations. For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess. Timing discrepancies effectively form a timing side channel.
Last updated: 15 October 2026 10:21 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (2)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-30 | Concealment and Misdirection | SC | Timing randomization or delays can mask true operation timing and mislead timing-based attacks. |
SC-31 | Covert Channel Analysis | SC | Observable timing discrepancies are a primary mechanism for constructing covert timing channels; analysis identifies and bounds them, limiting exploitation. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2021-43298 UPD | 7.7 | 9.8 | 0.0226 | 2022-01-25 |
CVE-2023-41313 UPD | 7.5 | 9.8 | 0.0105 | 2024-03-12 |
CVE-2026-77987 UPD | 7.5 | 9.8 | 0.0088 | 2026-09-22 |
CVE-2026-23519 UPD | 7.3 | 9.8 | 0.0056 | 2026-01-15 |
CVE-2024-42512 UPD | 6.6 | 8.6 | 0.0060 | 2025-02-10 |
CVE-2024-29995 | 6.4 | 8.1 | 0.0146 | 2024-08-13 |
CVE-2026-47783 UPD | 6.4 | 8.1 | 0.0126 | 2026-05-20 |
CVE-2026-41588 UPD | 6.3 | 9.0 | 0.0045 | 2026-05-08 |
CVE-2026-47784 UPD | 6.2 | 8.1 | 0.0055 | 2026-05-20 |
CVE-2026-16315 UPD | 6.2 | 8.7 | 0.0042 | 2026-08-06 |
CVE-2022-31142 UPD | 6.1 | 7.5 | 0.0150 | 2022-07-14 |
CVE-2026-42602 UPD | 6.0 | 8.1 | 0.0033 | 2026-05-13 |
CVE-2021-42016 UPD | 5.9 | 7.5 | 0.0063 | 2022-03-08 |
CVE-2024-23342 UPD | 5.9 | 7.4 | 0.0098 | 2024-01-23 |
CVE-2026-47373 UPD | 5.9 | 7.5 | 0.0049 | 2026-05-20 |
CVE-2026-6656 | 5.9 | 7.5 | 0.0049 | 2026-07-20 |
CVE-2026-13183 UPD | 5.9 | 7.5 | 0.0050 | 2026-07-22 |
CVE-2026-75589 UPD | 5.9 | 7.5 | 0.0051 | 2026-08-19 |
CVE-2023-25529 UPD | 5.8 | 8.0 | 0.0063 | 2023-09-20 |
CVE-2024-13939 UPD | 5.8 | 7.5 | 0.0037 | 2025-03-28 |
CVE-2025-70949 UPD | 5.8 | 7.5 | 0.0039 | 2026-03-05 |
CVE-2026-5086 UPD | 5.8 | 7.5 | 0.0044 | 2026-04-13 |
CVE-2025-49506 UPD | 5.8 | 7.5 | 0.0038 | 2026-08-06 |
CVE-2026-72700 UPD | 5.8 | 7.5 | 0.0043 | 2026-08-25 |
CVE-2026-16037 UPD | 5.8 | 7.5 | 0.0030 | 2026-09-08 |