EUVD-2026-31353
GHSA-37jv-v9vv-wxwv
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Catalyst is a web framework; attackers reach the login endpoint over the network (AV:N), not local access; AC:H reflects statistical timing measurement difficulty.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks.
These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.
AnalysisAI
Timing attack exposure in Catalyst::Plugin::Authentication (all versions through 0.10024) allows side-channel inference of stored passwords or password hashes through non-constant-time string comparison. The Perl built-in eq operator short-circuits on first character mismatch, leaking measurable timing differences that an attacker can exploit statistically across many authentication attempts to progressively recover credential material. No public exploit has been identified at time of analysis and SSVC exploitation status is confirmed as none, though the cryptographic weakness is real and patch availability is confirmed upstream.
Technical ContextAI
Catalyst::Plugin::Authentication (CPE: cpe:2.3:a:jjnapiork:catalyst::plugin::authentication) is a CPAN module providing pluggable authentication for the Catalyst MVC web framework in Perl. The root cause is CWE-208 (Observable Timing Discrepancy): Perl's eq operator performs lexicographic comparison and exits early on the first differing byte, causing comparison time to vary based on how many leading characters match. The affected module lib/Catalyst/Authentication/Credential/Password.pm used eq across all supported credential modes - plaintext, crypt-based, and hashed (MD5 in hex and Base64). The upstream fix replaces all eq calls with a _secure_compare() function adapted from Mojo::Util 9.45, which XORs all character pairs unconditionally and accumulates a result integer, ensuring constant-time execution regardless of input content.
RemediationAI
Upgrade to Catalyst::Plugin::Authentication 0.10_025 or the next stable release via CPAN (cpanm Catalyst::Plugin::Authentication or via your preferred CPAN client). The patching commit is available at https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/b0515f492257438cf07082acf1e10d06e8088a5e.patch and can be applied manually if the stable release is not yet available. Note that 0.10_025 carries an underscore version number indicating a CPAN trial/development release - verify production readiness before deploying. If upgrading is not immediately feasible, implement aggressive rate limiting and authentication throttling at the application or reverse-proxy layer (e.g., via Plack middleware or a WAF rule) to limit the number of timing samples an attacker can collect per IP per time window. Throttling does not eliminate the vulnerability but raises the attack cost substantially by increasing the time required for statistical recovery. Consider supplementing with TOTP or other second-factor authentication to render recovered password hashes insufficient for login.
Remote code execution in Catalyst::View::Wkhtmltopdf before 0.6.1 allows unauthenticated attackers to inject arbitrary s
Session ID disclosure in Catalyst::Plugin::Statsd for Perl (versions ≤0.10.0) occurs when the StatsD communication chann
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today