CVE-2026-16459CWE-208CWE-327

CVE-2026-16459

published August 13, 2026

CVSS

5.9

EPSS

Percentile

0.5

In the wild

Unconfirmed

What it is

Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.

The record

Technical detail

CVSS: 5.9 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00091 · 0.5th percentile
Weaknesses: CWE-208 · Observable Timing Discrepancy; CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published: 2026-08-13T13:17Z

References (1)

https://www.oberon.ch/security-advisories/cve-2026-16459/ · [email protected]

EPSS history

Timeline

13 AUG 08:29Z
Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto
cvelistv5