CVE-2026-8704
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.
Risk Assessment
An attacker could modify existing files, potentially leading to data integrity compromise or unauthorized operations. The risk affects Perl applications using this library.
Recommendation
Update Crypt::DSA to a version later than 1.19 if available, or apply a workaround by restricting file permissions. Consider auditing code that uses this library.
Other vulnerabilities in Crypt::DSA
See all- CVE-2026-12205Critical
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical 'r'.
- CVE-2026-14570High
A vulnerability in the Crypt::DSA library for Perl before version 1.22 causes insecure generation of DSA signing nonces and private keys due to a biased random generator. An attacker with access to a few signatures and the public key can recover the private key using a lattice attack.
- CVE-2026-8700High
Crypt::DSA versions before 1.20 for Perl generate seeds using the rand function, which is predictable and unsuitable for security usage.
Original NVD description (English source)
Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS