CVE-2026-16235
Deferred Deferred - Pending Action

Insecure Random Salt Generation in Crypt::Password Perl Module

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: CPANSec

Description
Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-16235
EUVD
EUVD-2026-45895

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
drsteve crypt_password to 0.28 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16235 affects the Crypt::Password Perl module versions up to 0.28. The vulnerability occurs because the module uses Perl's built-in rand function to generate salts for password hashing, which produces predictable values unsuitable for cryptographic use.

Detection Guidance

To detect this vulnerability, check if the Crypt::Password Perl module version 0.28 or earlier is installed on your system. Run: perl -MCrypt::Password -e 'print $Crypt::Password::VERSION' to verify the version. If the output is 0.28 or lower, the system is vulnerable.

Impact Analysis

An attacker could exploit this to bypass authentication by crafting specific salt values that match stored hashes, potentially gaining unauthorized access to systems relying on this module for password security.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements under GDPR and HIPAA, which mandate secure storage and handling of sensitive information like passwords.

Mitigation Strategies

Immediately upgrade the Crypt::Password module to the latest version using CPAN: cpan Crypt::Password. If upgrading is not possible, consider replacing the module with a more secure alternative for password hashing, such as Crypt::Eksblowfish or Crypt::Argon2.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16235. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart