cve: POSTCUT-005
alias: Session HMAC verifier timing side channel (custom non-CT compare in Rust)
cwe_primary: CWE-208
cwe_acceptable: [CWE-208, CWE-203, CWE-385, CWE-1254, CWE-310]
target_file: source.rs
vuln_lines: [34, 35, 36, 37, 38, 39, 40]
severity: high
vuln_class: timing_attack
exploit_pattern_regex: '(short[- ]circuit|early[- ]return|constant[- ]time|timing\s*attack|subtle::ConstantTimeEq|ct_eq|byte[- ]by[- ]byte)'
must_mention_any:
  - timing attack
  - short-circuit
  - early return
  - constant-time
  - byte-by-byte
  - ConstantTimeEq
  - subtle
  - timing side
  - sig[i] != expected[i]
  - return None
points: 30
memorization_resistant: true
notes: |
  Synthetic — novel. Same anti-pattern as POSTCUT-003 but in Rust. The
  `for i in 0..sig.len()` loop returns None on first mismatch — leaks
  byte position via timing. Fix: use `subtle::ConstantTimeEq` or
  `ring::constant_time::verify_slices_are_equal`.
  Pair with POSTCUT-003 to test if the hunter generalizes across languages.