CVE-2026-6659

Summary

Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.

The built-in rand function is predictable, and unsuitable for cryptography.

Affected Software

Weaknesses

• CWE-338: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

CVE Program Container

Additional References

• http://www.openwall.com/lists/oss-security/2026/05/08/17

References

• https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes
• https://github.com/ronsavage/Crypt-PasswdMD5/pull/3
• https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch
• https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47

• ←Previous
• Next→