Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Crypt::Password Perl module creates predictable password salts

CVE-2026-16235 · published 3 months ago
Summary

Versions of the Crypt::Password module for Perl generate password salts using a random function that can be guessed. This makes it easier for attackers to crack passwords that rely on those salts. Upgrade to a newer version of the module or switch to a library that uses a strong, unpredictable random generator.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– drsteve crypt::password <= 0.28
Debian:14 debian libcrypt-password-perl All versions
Ubuntu:26.10 canonical libcrypt-password-perl All versions
Original advisory text
Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
Crypt::Password versions through 0.28 for Perl generate insecure random values for salts.

These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Timeline
Published20 Jul 2026
Updated4 Nov 2026
First seen20 Jul 2026
Sources
CVE-2026-16235 · NVD
CVE-2026-16235 · MITRE
DEBIAN-CVE-2026-16235 · OSV
UBUNTU-CVE-2026-16235 · OSV
Track software like this
Free during beta