Home

Description

Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The built-in rand function is predictable, and unsuitable for cryptography.

PUBLISHED Reserved 2026-04-20 | Published 2026-05-08 | Updated 2026-05-26 | Assigner CPANSec

Problem types

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Product status

Default status
unaffected

Any version
affected

Timeline

2026-04-14:Issue reported to CPANSec
2026-04-20:Maintainer notified
2026-05-08:Vulnerability published
2026-05-23:Version 1.43 with fix uploaded to CPAN

References

www.openwall.com/lists/oss-security/2026/05/08/17

metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes release-notes

github.com/ronsavage/Crypt-PasswdMD5/pull/3 issue-tracking

github.com/...a2f821637db0296082297aa4b02254ab08f0dc5e.patch patch

metacpan.org/...PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm

cve.org (CVE-2026-6659)

nvd.nist.gov (CVE-2026-6659)

Download JSON