EUVD-2026-45894
GHSA-c9g9-v2j9-8ffv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote but timing attacks need many low-noise samples so AC:H; no auth needed (PR:N); leak is partial hash information not full plaintext, so C:L and I/A:N.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks.
The check_password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash.
AnalysisAI
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a stored password hash because check_password compares values with Perl's short-circuiting eq operator instead of a constant-time comparison. The flaw is classic CWE-208 (Observable Timing Discrepancy); it carries a CVSS 7.5 but a very low EPSS (0.14%, 4th percentile) and no public exploit identified at time of analysis, and SSVC records exploitation status as none. A vendor patch is available.
Technical ContextAI
Crypt::Password is a Perl convenience wrapper around crypt()-style password hashing distributed on CPAN by author DRSTEVE (CPE cpe:2.3:a:drsteve:crypt::password). Its check_password routine (see lib/Crypt/Password.pm lines ~190-193) validates a candidate by hashing it and comparing the result to the stored hash using the built-in eq string-equality operator. eq is not constant-time: it returns as soon as it finds the first differing byte, so the comparison duration correlates with how many leading characters match. This is the textbook root cause of CWE-208, where measurable timing discrepancies leak information about a secret. The correct mitigation class is a constant-time comparison (e.g. a length-independent XOR/accumulator compare) so that verification time is independent of how many bytes match.
RemediationAI
Patch available per vendor advisory - upgrade to the fixed release published on CPAN by author DRSTEVE above 0.28 (obtain the exact fixed version from the CPAN release page https://metacpan.org/release/DRSTEVE/Crypt-Password-0.28/source/lib/Crypt/Password.pm and the RT ticket https://rt.cpan.org/Ticket/Display.html?id=180162; the input confirms a patch exists but does not state the exact fixed version number, so verify it on CPAN before pinning). Debian users should apply the distribution security update once released for the two tracked releases. As an interim compensating control, replace the eq-based comparison in any wrapper code with a constant-time comparison and, at the deployment level, add rate-limiting and randomized delays on authentication endpoints that call check_password to raise the sampling cost of a timing attack - noting that added jitter increases latency and only slows, rather than eliminates, the leak. Reference oss-security discussion: https://seclists.org/oss-sec/2026/q3/176.
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password has
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could wea
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak a
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts
Private-key recovery in the Crypt::DSA Perl module (all versions before 1.22) stems from a biased random number generato
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl
Heap buffer overflow in Crypt::SysRandom::XS before version 0.010 allows denial of service through negative length param
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined
Secret-recovery via timing side channel in the Perl module Crypt::SecretBuffer before 0.019 lets remote attackers infer
Weak salt generation in Crypt::PasswdMD5 (Perl) through version 1.42 enables password hash cracking via predictable rand
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| forky, sid | vulnerable | 0.28-2 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today