CVE-2026-6659

Description

Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The built-in rand function is predictable, and unsuitable for cryptography.

PUBLISHED Reserved 2026-04-20 | Published 2026-05-08 | Updated 2026-05-08 | Assigner CPANSec

Problem types

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Product status

References

metacpan.org/...PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm

cve.org (CVE-2026-6659)

nvd.nist.gov (CVE-2026-6659)

Download JSON