Crypt::DSA EUVD-2026-41713

Exploitation requires that the target generated its DSA key and/or produced signatures using Crypt::DSA before version 1.22, so that the nonce and private key carry the fixed-high-bit bias from makerandom. The attacker must obtain the public key and a modest number of valid signatures created under that key - a single signature is insufficient; the lattice attack needs several. What limits exploitation: it is an offline cryptanalytic attack (no live access to the victim host is required, but signatures must be harvested first), it does not affect keys generated by fixed versions, and it is specific to DSA signing via this module - applications that use Crypt::DSA only for verification, or that never expose signatures, are not directly at risk of key recovery.

Signals are mixed and point to a real-but-not-urgent cryptographic weakness rather than a mass-exploitation event. CVSS 3.1 is 7.5 (AV:N/AC:L/PR:N/UI:N/C:H) reflecting the high-value outcome - full private-key disclosure - with no confidentiality-only scope. However, the CVSS AV:N/AC:L rating understates practical effort: exploitation is an offline mathematical attack requiring the attacker to first collect multiple valid signatures and the public key, so real-world complexity is higher than 'low'. SSVC aligns with a measured posture: Exploitation = none (no observed in-the-wild activity), Automatable = yes (the lattice attack scales once signatures are gathered), Technical Impact = partial. EPSS is low (0.21%, 11th percentile) and the CVE is not in CISA KEV. Net: prioritize for any system that signs with Crypt::DSA and exposes signatures, because the impact (permanent key compromise) is severe and irreversible, but this is not a drop-everything internet-worm scenario. No data conflict of note; the main caveat is that 'modest number of signatures' is not quantified in the advisory.

An attacker passively collects a handful of DSA signatures generated by an application using Crypt::DSA <1.22 (for example from signed messages, tokens, or artifacts) along with the corresponding public key. Because each signing nonce has a fixed high bit, the attacker feeds the signatures into a lattice (hidden-number-problem) solver and recovers the private key offline, then forges arbitrary valid signatures. No public exploit is identified at time of analysis, but the technique is standard cryptographic tooling.