CVE Catalog
CVE-2026-47373
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk0.39%
32th percentile - higher than 32% of all known CVEs
Summary
Crypt::SaltedHash for Perl versions up to 0.09 is susceptible to timing attacks. It uses Perl's built-in eq comparison, and timing discrepancies could be used to guess the underlying hash.
Risk Assessment
Attackers could perform a timing attack to guess password hashes, potentially leading to compromise of authentication credentials.
Recommendation
Update Crypt::SaltedHash to a version later than 0.09 or use an alternative library resistant to timing attacks.
Other vulnerabilities in Crypt::SaltedHash
Original NVD description (English source)
Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash.