Loading story…
A high-severity vulnerability, CVE-2026-16235, was disclosed in DRSTEVE's Perl module Crypt::Password, where versions through 0.28 generate password salts using Perl's built-in rand function. Because rand is predictable and not suitable for cryptographic use, the issue was classified as CWE-338 and assigned a CVSS v3.1 score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating potentially severe impact if affected applications rely on the module for password handling.
The disclosure said there is no known exploitation so far, but exploitation would be automatable and could have total technical impact. Maintainers and users were advised to avoid the module's default salt generation by supplying salts generated with a stronger source such as Crypt::URandom::Token, and to consider migrating away from Crypt::Password entirely because the package reportedly has not been updated since 2012.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A security notice disclosed CVE-2026-16235 in DRSTEVE's Crypt::Password Perl module, affecting versions through 0.28. The flaw stems from use of Perl's built-in rand function to generate salts, producing predictable and cryptographically insecure values.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
`CVE-2026-5088` affects `Apache::API::Password` in the `Apache2-API` Perl distribution through version `0.5.2`, where password salt generation can fall back to Perl’s built-in `rand` function if `Crypt::URandom` or `Bytes::Random::Secure` is unavailable. The vulnerable `_make_salt` and `_make_salt_bcrypt` methods may therefore produce weak, predictable salt values for password hashing, exposing deployments to reduced password protection and fitting `CWE-338`, use of a cryptographically weak pseudo-random number generator. The issue was disclosed by the CPAN Security Group, and maintainer Jacques Deguest said it was fixed in version `0.5.3`, which was released to CPAN. Organizations using the module are advised to upgrade to `0.5.3` or later and ensure `Crypt::URandom` is installed to prevent insecure fallback behavior during salt generation.
Jun 29, 2026
Two Perl distributions, **Ado::Sessions** and **Solstice::Session**, were disclosed with vulnerabilities that generate session identifiers from weak, predictable inputs, creating a risk of session prediction and unauthorized access. In **CVE-2026-5083**, Ado::Sessions through version `0.935` uses a SHA-1 hash seeded with Perl `rand`, epoch time, and process ID; in **CVE-2026-5085**, Solstice::Session through version `1440` uses an MD5 digest built from epoch time, a stringified hash reference, Perl `rand()`, and process ID, with the same pattern also affecting `Solstice::Subsession` via `_generateID`. Both flaws were classified under **CWE-340** and **CWE-338**, reflecting predictable values and insufficient entropy in security-sensitive randomness. The disclosures warn that attackers may be able to infer or guess the underlying inputs—particularly time and PID values—and derive valid session tokens to hijack active sessions. The Ado issue is compounded by the project’s abandoned status: the distribution is no longer maintained, has been removed from the CPAN index, and remains available only on BackPAN.
Jun 29, 2026
A high-severity vulnerability, **CVE-2026-13577**, was disclosed in **Dancer2** for Perl that can cause applications to generate predictable session IDs when cryptographically secure random number generator modules are unavailable. The issue affects Dancer2 versions through `2.1.0` and stems from `Dancer2::Core::Role::SessionFactory::generate_id` silently falling back to a session identifier derived from Perl’s built-in `rand()` and other low-entropy values instead of a secure source of randomness. Because Perl’s `rand()` is not suitable for security-sensitive use and may be seeded with only 32 bits, attackers could guess valid session identifiers and gain unauthorized access to user sessions. The flaw is rated **CVSS 8.2** and mapped to **CWE-338** and **CWE-340**. Maintainers recommend upgrading to **Dancer2 2.1.1 or later** and ensuring `Math::Random::ISAAC::XS` or `Crypt::URandom` is installed and available in the application’s `PERL5LIB` path to prevent the insecure fallback.
Jul 20, 2026