CVE-2026-6659
7.5 HIGHCrypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts
Published: 2026-05-08 · Last updated: 2026-05-26
Severity and scoring
- CVSS
- 7.5 HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CWE
- CWE-338
Description
Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The built-in rand function is predictable, and unsuitable for cryptography.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-6659
- [Other]https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch
- [Other]https://github.com/ronsavage/Crypt-PasswdMD5/pull/3
- [Other]https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm#L35-47
- [Other]https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes
- [Other]http://www.openwall.com/lists/oss-security/2026/05/08/17
Related CVEs
Same CWE
- CVE-2026-11832 — Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce (9.1 CRITICAL)
- CVE-2026-9638 — Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts (7.5 HIGH)
- CVE-2026-46493 — HAX CMS helps manage microsite universe with PHP or NodeJs backends (7.5 HIGH)
- CVE-2026-11347 — The linqi application contains hardcoded cryptographic keys
- CVE-2026-41858 — Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a... (7.5 HIGH)