Crypt::SaltedHash vulnerabilities

2 known vulnerabilities in Crypt::SaltedHash from RRWO. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Crypt::SaltedHash: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

  CVE-2026-47372May 20, 2026RRWO

  Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

• 7.5 High severity

  Crypt::SaltedHash: Observable Timing Discrepancy

  CVE-2026-47373May 20, 2026RRWO

  Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash.