Every CVE Search/ Get API key

CVE-2026-47372

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts

9.1 CriticalFix available

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.

These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.40%Up 0.4 points since May 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.

These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Record
CVE-2026-47372
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-338
Updated
2026-11-02
EUVDEUVD-2026-31198 9.1

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.

These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Record
EUVD-2026-31198
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-h295-pfx3-r298 9.1

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. ...

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.

These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Record
GHSA-h295-pfx3-r298
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-338
Updated
2026-11-02
NVD 9.1

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.

These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Record
CVE-2026-47372
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-338
Updated
2026-11-02
OSV 9.1

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.

These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Record
CVE-2026-47372
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-338
Updated
2026-11-02
OSVDEBIAN-CVE-2026-47372 9.1

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Record
DEBIAN-CVE-2026-47372
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-47372 9.1

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Record
UBUNTU-CVE-2026-47372
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:10836-1 No score

perl-Crypt-SaltedHash-0.110.0-1.1 on GA media

These are all security issues fixed in the perl-Crypt-SaltedHash-0.110.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10836-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20986-1 No score

Security update for perl-Crypt-SaltedHash

This update for perl-Crypt-SaltedHash fixes the following issues:

Changes in perl-Crypt-SaltedHash:

updated to 0.110.0 (0.11)

  • 0.11 2026-05-20 14:05:07+01:00 Europe/London

    • Fixed metadata
    • Moved author tests into xt

  • 0.10 2026-05-19

    • Maintenance taken over by Robert Rothenberg [email protected]
    • Updated the Git Repository
    • Updated copyright year
    • Minimum Perl version is v5.6.0
    • Added missing prerequisites, fixes RT#116392
    • Security: Use system randomness source to generate the salt CVE-2026-47372 bsc#1265927
    • Security: Use constant-time comparison of hashes CVE-2026-47373 bsc#1265912
    • Deprecated module
    • Updated README
Record
openSUSE-SU-2026:20986-1
Updated
2026-11-02
OSVUSN-8418-1 No score

libcrypt-saltedhash-perl vulnerability

It was discovered that Crypt-SaltedHash incorrectly generated salts using a cryptographically weak pseudo-random number generator. An attacker could possibly use this issue to predict generated salts, leading to a weakening of cryptographic protections.

Record
USN-8418-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libcrypt-saltedhash-perl
Debian:12
 All versions, plus listed versions
0.09-30.11-10.12-1
 None known
libcrypt-saltedhash-perl
Debian:13
 All versions, plus listed versions
0.09-30.11-10.12-1
 None known
libcrypt-saltedhash-perl
Debian:14
 before 0.11-1, plus listed versions
0.09-3
0.11-1
libcrypt-saltedhash-perl
Ubuntu:Pro:16.04:LTS
 before 0.09-1ubuntu0.16.04.1~esm1, plus listed versions
0.09-1
0.09-1ubuntu0.16.04.1~esm1
libcrypt-saltedhash-perl
Ubuntu:Pro:18.04:LTS
 before 0.09-1ubuntu0.18.04.1~esm1, plus listed versions
0.09-1
0.09-1ubuntu0.18.04.1~esm1
libcrypt-saltedhash-perl
Ubuntu:Pro:20.04:LTS
 before 0.09-1ubuntu0.20.04.1~esm1, plus listed versions
0.09-1
0.09-1ubuntu0.20.04.1~esm1
libcrypt-saltedhash-perl
Ubuntu:Pro:22.04:LTS
 before 0.09-1.1ubuntu0.1~esm1, plus listed versions
0.09-1.1
0.09-1.1ubuntu0.1~esm1
libcrypt-saltedhash-perl
Ubuntu:Pro:24.04:LTS
 before 0.09-3ubuntu0.24.04.1~esm1, plus listed versions
0.09-3
0.09-3ubuntu0.24.04.1~esm1
libcrypt-saltedhash-perl
Ubuntu:25.10
 before 0.09-3ubuntu0.25.10.1, plus listed versions
0.09-3
0.09-3ubuntu0.25.10.1
libcrypt-saltedhash-perl
Ubuntu:Pro:26.04:LTS
 before 0.09-3ubuntu0.26.04.1~esm1, plus listed versions
0.09-3
0.09-3ubuntu0.26.04.1~esm1
perl-Crypt-SaltedHash
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 0.110.0-1.1
0.110.0-1.1
perl-Crypt-SaltedHash
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 0.110.0-bp160.1.1
0.110.0-bp160.1.1
perl-Crypt-SysRandom
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 0.7.0-bp160.1.1
0.7.0-bp160.1.1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-47372 is a critical vulnerability (CVSS 9.1) in Rrwo Crypt::saltedhash, published May 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in libcrypt-saltedhash-perl 0.11-1.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open