What is the CVSS score of CVE-2026-12205?

CVE-2026-12205 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Crypt::DSA are affected by CVE-2026-12205?

Crypt::DSA for Perl versions before 1.21 contain a critical flaw in cryptographic nonce handling that enables attackers to recover private signing keys when the same key object signs multiple…. A patch is available.

How to fix or mitigate CVE-2026-12205?

Within 24 hours: Identify all systems using Crypt::DSA and determine which signing keys have been reused for multiple signature operations. Within 7 days: Upgrade to Crypt::DSA version 1.21 or later across all systems; if upgrades cannot be completed immediately, discontinue signing operations with affected Key objects. Within 30 days: Rotate all cryptographic keys that generated multiple signatures under affected versions and perform forensic audit of all signatures created during the vulnerability period for potential forgery.

Crypt::DSA CVE-2026-12205

EUVD-2026-37016 CRITICAL

Reusing a Nonce, Key Pair in Encryption (CWE-323)

2026-06-15

GHSA-88g7-87jg-w4q9

Information Disclosure Red Hat

9.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network-observable signatures enable unauthenticated key recovery; AC:H because attacker must collect multiple signatures and perform cryptanalytic computation; full C/I impact from private key exposure and signature forgery.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 16, 2026 - 02:15 EUVD

Analysis Generated

Jun 15, 2026 - 14:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Private-key recovery is possible in Crypt::DSA for Perl (all versions before 1.21) because the module caches the per-signature DSA nonce (k) inside the Key object and never clears it, causing every call to sign() after the first to reuse the identical nonce and produce signatures with matching r values. Any attacker who can observe two or more DSA signatures produced by the same Key object can apply well-known algebraic techniques to recover the private key entirely, after which they can forge arbitrary signatures. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the cryptographic impact is catastrophic: all keys used to sign more than once under an affected version must be treated as fully compromised.

Technical ContextAI

DSA (Digital Signature Algorithm, FIPS 186) mandates that each signature operation use a fresh, secret, uniformly random nonce k. The signature pair (r, s) is computed as r = (g^k mod p) mod q and s = k^{-1}(H(m) + x*r) mod q. If two signatures share the same k (evidenced by identical r values), an adversary holding both (r, s1, m1) and (r, s2, m2) can trivially solve the resulting two-equation system to recover the private key x: x = (s1 - s2)^{-1} * (s1*H(m2) - s2*H(m1)) mod q. The root cause in Crypt::DSA is CWE-323 (Reusing a Nonce, Key Pair in Encryption): the Crypt::DSA::sign() method stores nonce material in the Key object on first invocation and never clears or regenerates it, so every subsequent invocation on the same object silently reuses the cached value. The affected distribution is Crypt-DSA on CPAN (MetaCPAN: https://metacpan.org/dist/Crypt-DSA), and the flaw is visible in the 1.20 source at Crypt/DSA.pm line 47.

RemediationAI

Vendor-released patch: Crypt-DSA 1.21, available on CPAN and documented in the changelog at https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.21/changes. Upgrade immediately via cpanm Crypt::DSA or the equivalent CPAN client. Because the module was already marked deprecated in version 1.20, the advisory strongly recommends migrating away from Crypt::DSA entirely to an actively maintained cryptographic library (such as Crypt::OpenSSL::DSA or a higher-level abstraction). Critically, any private key that was used to produce more than one signature via a Crypt::DSA Key object under an affected version must be treated as compromised: revoke those keys, generate fresh key material, and re-sign any artifacts (packages, certificates, tokens) that used the compromised keys. There is no runtime workaround that safely preserves the broken sign() path - the only correct compensating control prior to patching is to avoid invoking sign() more than once per Key object per process, which requires application-level code changes and carries implementation risk; patching to 1.21 is strongly preferred.