EUVD-2026-41713
GHSA-v6rc-95xw-8xp5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Offline lattice attack requiring collection of multiple signatures raises AC to High; no auth or interaction needed (PR:N/UI:N); impact is full private-key disclosure (C:H), with forgery a downstream consequence not scored here.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery.
"Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer for prime search. The signing nonce and the private key are drawn from makerandom. Because the high bit is always set, the result is not uniform: its top bit is fixed, producing insecure values."
An attacker who collects a modest number of signatures under an affected key, together with the public key, can recover the private key with a lattice attack.
Keys used to sign with an affected version should be considered compromised and new keys should be generated.
AnalysisAI
Private-key recovery in the Crypt::DSA Perl module (all versions before 1.22) stems from a biased random number generator that forces the high bit of every value returned by Crypt::DSA::Util::makerandom, making both the DSA signing nonce and the private key non-uniform. An attacker who obtains the public key plus a modest number of signatures produced under an affected key can reconstruct the private key using a lattice attack. There is no public exploit identified at time of analysis, but the underlying nonce-bias lattice technique is well documented and EPSS remains low at 0.21%.
Technical ContextAI
Crypt::DSA is a pure-Perl implementation of the Digital Signature Algorithm (DSA/DSS). The flaw lives in the utility routine Crypt::DSA::Util::makerandom (lib/Crypt/DSA/Util.pm), which was designed to force the top bit high so that prime-search candidates are exactly N bits wide. That behavior is correct for generating prime candidates but wrong when the same function is reused to draw the per-signature nonce (k) and the long-term private key (x): the fixed high bit removes one bit of entropy and, more importantly, makes the values non-uniform with a known structural bias. DSA is acutely sensitive to nonce bias - even a few known bits of k across several signatures let an attacker set up a hidden number problem and solve for the private key via lattice reduction (LLL/BKZ). This maps to CWE-330 (Use of Insufficiently Random Values); the root cause is not a broken PRNG source but a post-processing step that destroys uniformity.
RemediationAI
Vendor-released patch: Crypt::DSA 1.22 - upgrade to 1.22 or later from CPAN immediately (see the change log at https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.22/changes and the fix diff at https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.22/diff/TIMLEGGE/Crypt-DSA-1.21). Upgrading alone is not sufficient: because the bias affects key generation and signing, any key that was ever generated or used to sign with an affected version must be treated as compromised and rotated - generate fresh DSA keys (or migrate to a modern scheme) after patching and re-issue/re-sign as needed. As a compensating step until keys are rotated, limit exposure of existing signatures produced by affected keys (an attacker needs several to run the lattice attack) and revoke trust in the old public keys where a revocation mechanism exists; note this can break signature verification for consumers still pinned to the old key. Consult the CPANSec advisory at https://seclists.org/oss-sec/2026/q3/28 and https://nvd.nist.gov/vuln/detail/CVE-2026-14570 for details.
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password has
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could wea
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak a
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl
Heap buffer overflow in Crypt::SysRandom::XS before version 0.010 allows denial of service through negative length param
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined
Secret-recovery via timing side channel in the Perl module Crypt::SecretBuffer before 0.019 lets remote attackers infer
Weak salt generation in Crypt::PasswdMD5 (Perl) through version 1.42 enables password hash cracking via predictable rand
Same weakness CWE-330 – Use of Insufficiently Random Values
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today