CWE-203: Observable Discrepancy
Also known as: Side Channel Attack
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Last updated
Overview
CWE-203 (Observable Discrepancy) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Background
Discrepancies may be observable based on timing, control flow, communications (such as replies or requests), or general behavior.
Real-world CVEs
272 recorded CVEs are caused by CWE-203 (Observable Discrepancy), including 1 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 19 new CWE-203 CVEs have been recorded so far in 2026 (54 in 2025).