---
id: CVE-2022-29185
aliases:
  - RUSTSEC-2022-0018
  - GHSA-8vxv-2g8p-2249
title: Timing attack
summary: Timing attack
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N'
vendor: totp-rs
product: totp-rs
ecosystem: rust
affected:
  - 'totp-rs >= 0.0.0-0, < 1.1.0'
patched:
  - totp-rs 1.1.0
published: '2022-05-09'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:03.407014913Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2022-0018'
references:
  - url: 'https://crates.io/crates/totp-rs'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2022-0018.html'
  - url: 'https://github.com/constantoine/totp-rs/issues/13'
tags:
  - osv
  - rust
epss: 0.00863
epssPercentile: 0.58412
ingestedAt: '2026-10-13T11:45:30.155Z'
---

## Overview

Affecting versions did not compare tokens in constant time, which could make it possible for an attacker to guess the 2fa token of a user.

This has been fixed by using using the crate constant_time_eq for comparison.

## Affected packages

- `totp-rs >= 0.0.0-0, < 1.1.0`

## Remediation

Upgrade to a patched release:

- `totp-rs 1.1.0`