CVE-2026-16235
Crypt::Password versions up to 0.28 for Perl generate salts using the built‑in rand function, which is predictable and unsuitable for cryptographic use. This flaw can lead to weak password protection and compromise security. The vulnerability is rated critical with a CVSS score of 9.8.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Perl's Crypt::Password module, versions 0.28 and earlier.
Real-world impact
An attacker could predict the salts used in password hashing, making it easier to crack passwords and gain unauthorized access to systems that rely on this module.
Why this severity
The CVSS score is high because the flaw is network‑exploitable (AV:N), requires low attack complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and can compromise confidentiality, integrity, and availability (C:H/I:H/A:H).
What to do about it
- ›Avoid using Crypt::Password for generating salts; use a library that employs a cryptographically secure random number generator.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources.