How severe is CVE-2024-11862?

CVE-2024-11862 has a CVSS 4.0 base score of 5.1, rated medium severity.

Is CVE-2024-11862 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2024-11862?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-11862 have an EU (EUVD) identifier?

Yes. CVE-2024-11862 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-3394.

When was CVE-2024-11862 published?

CVE-2024-11862 was published on 2024-11-27 and last updated on 2026-06-17.

CVE-2024-11862

CVE-2024-11862 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-385.

Key facts

Severity: Medium (CVSS 4.0 base score 5.1)
EPSS exploit prediction: 0% (4th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-3394
Weakness: CWE-385
Published: 2024-11-27
Last modified: 2026-06-17

Description

Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a timing attacks

Frequently asked questions

What is CVE-2024-11862?: Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a timing attacks
How severe is CVE-2024-11862?: CVE-2024-11862 has a CVSS 4.0 base score of 5.1, rated medium severity.
Is CVE-2024-11862 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2024-11862?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-11862 have an EU (EUVD) identifier?: Yes. CVE-2024-11862 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-3394.
When was CVE-2024-11862 published?: CVE-2024-11862 was published on 2024-11-27 and last updated on 2026-06-17.

References

https://github.com/Devolutions/XTS.NET/security/advisories/GHSA-j6vm-4r7g-x4gr

Other CWE-385 vulnerabilities

CVE-2026-5598 — High (CVSS 7.5): Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This…
CVE-2025-59425 — High (CVSS 7.5): vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support…
CVE-2020-25658 — High (CVSS 7.5): It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA…
CVE-2025-0306 — High (CVSS 7.4): A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the…
CVE-2023-46809 — High (CVSS 7.4): Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL…
CVE-2023-3640 — High (CVSS 7.0): A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to…

Browse all CWE-385 vulnerabilities →