CVE-2019-10071

CVE-2019-10071 is a critical timing side-channel vulnerability affecting Apache Tapestry, where the comparison of HMAC signatures in form submissions uses String.equals(). This flaw allows an attacker to discern the correct signature, potentially leading to remote code execution. With a CVSS score of 9.8, it presents a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Despite its critical severity, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.