CVE Catalog
CVE-2026-16235
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.31%
23th percentile - higher than 23% of all known CVEs
Summary
Vulnerability in Crypt::Password for Perl up to version 0.28 causes generation of insecure, predictable salt values using the built-in rand function, which is unsuitable for cryptographic purposes.
Risk Assessment
An attacker can predict the salt and perform brute-force or dictionary attacks on passwords, leading to compromise of credential confidentiality.
Recommendation
Immediately update Crypt::Password to a version later than 0.28 or use an alternative library that employs a cryptographically secure random number generator.
Original NVD description (English source)
Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.