CVE-2026-6656

HighCVSS 7.5

Published: 20/07/2026(UTC)Updated: 20/07/2026(UTC)Translated: 21/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A vulnerability in the Crypt::Password library for Perl (versions up to 0.28) allows timing attacks. The check_password method uses the eq operator, enabling attackers to guess the hash based on response time discrepancies.

Risk Assessment

An attacker can remotely recover the password hash by measuring server response times, compromising authentication data confidentiality.

Recommendation

Update Crypt::Password to version 0.29 or later, which includes a fix for timing attack protection.

Other vulnerabilities in Crypt::Password

CVE-2026-16235Critical
Vulnerability in Crypt::Password for Perl up to version 0.28 causes generation of insecure, predictable salt values using the built-in rand function, which is unsuitable for cryptographic purposes.

Original NVD description (English source)

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash.