CVE-2026-47372

32th percentile - higher than 32% of all known CVEs

Vulnerability in the Crypt::SaltedHash library for Perl (versions up to 0.09) uses the built-in rand function for salt generation. This function is predictable and unsuitable for cryptographic purposes, allowing an attacker to reproduce the salt.

The risk is that an attacker can predict the salt used for password hashing, facilitating brute-force or dictionary attacks on stored passwords, potentially leading to user account compromise.

Update the Crypt::SaltedHash library to a version newer than 0.09 that uses a secure random number generator. If an update is unavailable, replace it with another cryptographic library, such as Crypt::PBKDF2.