Secret disclosure and impersonation via variable-time comparisons

Timing discrepancy in affected Red Hat WildFly Elytron releases allows remote attackers to read secrets or impersonate authenticated users. GeneralName and other security-sensitive comparison sites use java.util.Arrays.equals on attacker-influenced byte arrays, returning sooner on a mismatch instead of comparing every byte in constant time. Exploitation requires repeated unauthenticated network measurements precise enough to distinguish response-time differences; the bounded consequences are secure-information disclosure or authenticated-user impersonation.