DRSTEVE Crypt::Password vulnerabilities

Latest DRSTEVE Crypt::Password CVEs

Newest publication first

1. CVE-2026-16235 Crypt::Password versions through 0.28 for Perl generate insecure random values for salts

   Published 2026-07-20

   Critical·CVSS 9.8 EPSS 0.55%

   Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

2. CVE-2026-6656 Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks

   Published 2026-07-20

   High·CVSS 7.5 EPSS 0.49%

   Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.