CVE-2026-8700
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Crypt::DSA versions before 1.20 for Perl generate seeds using the rand function, which is predictable and unsuitable for security usage.
Risk Assessment
The use of predictable seeds may weaken cryptographic security, exposing the organization to attacks.
Recommendation
It is recommended to upgrade to Crypt::DSA version 1.20 or newer to ensure proper seed generation.
Other vulnerabilities in Crypt::DSA
See all- CVE-2026-12205Critical
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical 'r'.
- CVE-2026-14570High
A vulnerability in the Crypt::DSA library for Perl before version 1.22 causes insecure generation of DSA signing nonces and private keys due to a biased random generator. An attacker with access to a few signatures and the public key can recover the private key using a lattice attack.
- CVE-2026-8704Medium
Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.
Original NVD description (English source)
Crypt::DSA versions before 1.20 for Perl generate seeds using rand. Seeds were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS