Crypt::Password vulnerabilities

2 known vulnerabilities in Crypt::Password from DRSTEVE. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Crypt::Password: Observable Timing Discrepancy

  CVE-2026-6656Jul 20, 2026DRSTEVE

  Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash.

• 9.8 Critical severity

  Crypt::Password: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

  CVE-2026-16235Jul 20, 2026DRSTEVE

  Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.