SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:21608-1 advisory.

    Changes in ongres-scram:

    - Version 3.2
      * Fix Timing Attack Vulnerability in SCRAM Authentication         (bsc#1250399, CVE-2025-59432)
      * Updated dependencies and maven plugins
      * Use central-publishing-maven-plugin to deploy to Maven Central.

    - Do not create multirelease jar if the only Java 9+ class file is       module-info.class

    Changes in ongres-stringprep:

    - Do not create multirelease jar if the only Java 9+ class file is       module-info.class

    Changes in plexus-testing:

    - The build without tests does not need the full junit5; the       junit5-minimal (built with ant) is enough

    Changes in maven:

    - Upgrade to upstream version 3.9.14

      * Bug Fixes

        - plexus-testing dependencies should be used in test scope

    - Upgrade to upstream version 3.9.13
      * Bug Fixes
        - Bug: SecDispatcher is managed by legacy Plexus DI
        - [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8           Java version in ranges as well

      * Maintenance

        - Update Maven plugin versions in default-bindings.xml
        - Migrate to JUnit 5 - avoid using TestCase

    Changes in maven-doxia:

    Upgrade to upstream version 2.1.0:

      * New features and improvements

        - Distinguish between linebreaks for formatting markup and           linebreaks in output
        - Return SinkEventAttributes instead of super class           MutableAttributeSet for filterAttributes
        - Optionally leave fragments of internal links untouched         Support strikethrough for Markdown sink
        - DOXIA-770: Only escape when necessary
        - DOXIA-760: Clarify table justification semantics and introduce           new JUSTIFY_DEFAULT alignment
        - DOXIA-756: Allow to customize macro execution
        - DOXIA-759: Support anchors in MarkdownSink

      * Bug Fixes

        - MarkdownSink: Fix verbatim inside table cell
        - Make sure to emit metadata prior everything else
        - Convert all globally available attributes to HTML5 compliant           ones
        - Html5BaseSink: Convert non-compliant HTML5 attributes to           compliant ones
        - Support name attribute in a element still in XHTML5
        - Never emit Markdown inside HTML context
        - Use JSoup to convert HTML to XHTML after parsing with Flexmark
        - DOXIA-764: Strip leading newline after
        - DOXIA-763: Distinguish between verbatim source and non-source           in MarkdownSink
        - DOXIA-758: Consider emitComments flag in MarkdownSink
        - DOXIA-757: Don't strip leading # from link names
        - DOXIA-753: Do not end lists with a blank line         + DOXIA-751: Linked inline code must be emitted in right order         + DOXIA-749: Correctly indent and separate blocks inside list           items         + DOXIA-750: Properly apply inlines inside HTML blocks         + DOXIA-747: Emit headings at beginning of line for Markdown

      * Documentation updates

        + Site: Convert APT to Markdown         + Improve documentation of supported extensions         + (doc) Fix missing references in JavaDocs

      * Maintenance

        + Cleanup tests         + JUnit Jupiter best practices         + Remove commons-lang3 and commons-text dependencies         + feat: enable prevent branch protection rules         + Cleanup pom, remove redundant dependencies         + Drop almost all usages of plexus-utils         + Remove not used and outdated clirr-maven-plugin         + Enable Github Issues         + DOXIA-772: Deprecate Sink.sectionTitle() and sectionTitle_()         + DOXIA-754: Clarify method order for nested lists

    Changes in mojo-parent:

    - Do not import junit-bom in the parent. This creates unnecessary       build cycles with junit5.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2025-20059-1 advisory.

    - CVE-2025-59432: Fixed timing attack vulnerability in SCRAM Authentication (bsc#1250399)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:4054-1 advisory.

    - CVE-2025-59432: Fixed timing attack vulnerability in SCRAM Authentication (bsc#1250399)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988625 advisory.

    SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication     and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack     vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to     compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-     circuit comparison, the execution time varies depending on how many leading bytes match. This behavior     could allow an attacker to perform a timing side-channel attack and potentially infer sensitive     authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has     been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-     time comparison.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication     and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack     vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to     compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-     circuit comparison, the execution time varies depending on how many leading bytes match. This behavior     could allow an attacker to perform a timing side-channel attack and potentially infer sensitive     authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has     been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-     time comparison. (CVE-2025-59432)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication
    and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack
    vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to
    compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-
    circuit comparison, the execution time varies depending on how many leading bytes match. This behavior
    could allow an attacker to perform a timing side-channel attack and potentially infer sensitive
    authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has
    been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-
    time comparison. (CVE-2025-59432)

ID	Name	Product	Family	Severity
315068	SUSE SLES16 Security Update : ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu (SUSE-SU-2026:21608-1)	Nessus	SuSE Local Security Checks	high
276598	openSUSE 16 Security Update : ongres-scram (openSUSE-SU-2025-20059-1)	Nessus	SuSE Local Security Checks	high
275281	SUSE SLES15: ongres-scram / ongres-scram-client / ongres-scram-javadoc / etc (SUSE-SU-2025:4054-1)	Nessus	SuSE Local Security Checks	high
272111	Unity Linux 20.1070e Security Update: ongres-scram (UTSA-2025-988625)	Nessus	Unity Linux Local Security Checks	high
266049	Linux Distros Unpatched Vulnerability : CVE-2025-59432	Nessus	Misc.	high
435334	SCA: security update for com.ongres.scram:scram-common (GHSA-3wfh-36rx-9537)	Tenable Cloud Security	SCA Checks	high
435334	SCA: security update for com.ongres.scram:scram-common (GHSA-3wfh-36rx-9537)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-59432

high

Tenable Plugins

high

high

high

high

high

high

high