These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| DRSTEVE | Crypt::Password | unaffected |
|
No data.
No data.
No data available yet.
Vendor Workaround
Users can generate a salt manually using a module such as Crypt::URandom::Token, and pass the salt directly to the password and crypt_password methods. This module has not been updated since 2012. Users should migrate to an alternative solution.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 20 Jul 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Mon, 20 Jul 2026 07:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography. | |
| Title | Crypt::Password versions through 0.28 for Perl generate insecure random values for salts | |
| Weaknesses | CWE-338 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-07-20T18:38:12.633Z
Reserved: 2026-07-19T15:48:13.976Z
Link: CVE-2026-16235
Vulnrichment
Updated: 2026-07-20T18:38:12.633Z
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.