A timing attack was discovered in the function for CSRF token validation of the "Ruby rack protection" framework.