{"id":"CVE-2025-40920","aliases":["DEBIAN-CVE-2025-40920","EUVD-2025-24168","GHSA-5xmm-95mj-42h8","UBUNTU-CVE-2025-40920"],"status":"published","title":"Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces","description":"Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.\n  *  Data::UUID does not use a strong cryptographic source for generating UUIDs.\n  *  Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.\n  *  The nonces should be generated from a strong cryptographic source, as per RFC 7616.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00471,"percentile":0.41034,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-338","CWE-340"],"published":"2025-08-11T20:19:57Z","modified":"2026-10-28T02:30:32Z","fixes":[{"ecosystem":"Debian:14","package":"libcatalyst-authentication-credential-http-perl","fixed_in":["1.018-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libcatalyst-authentication-credential-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.018-2","1.018-3","1.018-4","1.019-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libcatalyst-authentication-credential-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.018-3","1.018-4","1.019-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libcatalyst-authentication-credential-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.018-4"}]}],"versions":["1.018-3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libcatalyst-authentication-credential-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.016-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libcatalyst-authentication-credential-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.016-3","1.018-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libcatalyst-authentication-credential-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.018-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcatalyst-authentication-credential-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.018-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcatalyst-authentication-credential-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.018-2","1.018-3"]}],"products":[{"vendor":"ether","product":"catalyst::authentication::credential::http"}],"references":[{"url":"https://security.metacpan.org/patches/C/Catalyst-Authentication-Credential-HTTP/1.018/CVE-2025-40920-r1.patch","tags":["patch","fix"]},{"url":"https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/pull/1","tags":["issue-tracking","report"]},{"url":"https://metacpan.org/release/ETHER/Catalyst-Authentication-Credential-HTTP-1.018/source/lib/Catalyst/Authentication/Credential/HTTP.pm#L391","tags":["web"]},{"url":"https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations","tags":["web"]},{"url":"https://datatracker.ietf.org/doc/html/rfc7616#section-5.12","tags":["web"]},{"url":"https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18","tags":["patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2025/08/12/1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40920","tags":["advisory"]},{"url":"https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch"},{"url":"https://github.com/advisories/GHSA-5xmm-95mj-42h8"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40920.json","tags":["advisory"]},{"url":"https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-40920","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-40920","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40920","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/31902514/","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-40920","title":"Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces","description":"Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.\n  *  Data::UUID does not use a strong cryptographic source for generating UUIDs.\n  *  Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.\n  *  The nonces should be generated from a strong cryptographic source, as per RFC 7616.","status":"published","published":"2025-08-11T20:19:57.516Z","modified":"2026-01-17T20:23:09.178Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-340","CWE-338"],"updated_at":"2026-11-02T14:32:34.434755Z"}],"euvd":[{"id":"EUVD-2025-24168","description":"Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.\n  *  Data::UUID does not use a strong cryptographic source for generating UUIDs.\n  *  Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.\n  *  The nonces should be generated from a strong cryptographic source, as per RFC 7616.","status":"published","published":"2025-08-11T20:19:57Z","modified":"2026-01-17T20:23:09Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:48:50.374471Z"}],"ghsa":[{"id":"GHSA-5xmm-95mj-42h8","title":"Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces...","description":"Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.  *  Data::UUID does not use a strong cryptographic source for generating UUIDs.\n  *  Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.\n  *  The nonces should be generated from a strong cryptographic source, as per RFC 7616.","status":"published","published":"2025-08-11T21:31:40Z","modified":"2026-01-17T21:30:27Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:05:39.318179Z"}],"nvd":[{"id":"CVE-2025-40920","description":"Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.\n  *  Data::UUID does not use a strong cryptographic source for generating UUIDs.\n  *  Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.\n  *  The nonces should be generated from a strong cryptographic source, as per RFC 7616.","status":"published","published":"2025-08-11T21:15:28.087Z","modified":"2026-06-17T09:22:17.803Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-338","CWE-340"],"updated_at":"2026-11-02T14:11:22.953396Z"}],"osv":[{"id":"CVE-2025-40920","title":"Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces","description":"Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.\n  *  Data::UUID does not use a strong cryptographic source for generating UUIDs.\n  *  Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.\n  *  The nonces should be generated from a strong cryptographic source, as per RFC 7616.","status":"published","published":"2025-08-11T20:19:57.516Z","modified":"2026-10-28T02:30:32.607552399Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-338","CWE-340"],"updated_at":"2026-11-02T15:44:49.394967Z"},{"id":"DEBIAN-CVE-2025-40920","description":"Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.   *  Data::UUID does not use a strong cryptographic source for generating UUIDs.   *  Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.   *  The nonces should be generated from a strong cryptographic source, as per RFC 7616.","status":"published","published":"2025-08-11T21:15:28.087Z","modified":"2026-09-01T20:05:52.684856683Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:46.998514Z"},{"id":"UBUNTU-CVE-2025-40920","description":"Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.   *  Data::UUID does not use a strong cryptographic source for generating UUIDs.   *  Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.   *  The nonces should be generated from a strong cryptographic source, as per RFC 7616.","status":"published","published":"2025-08-11T21:15:00Z","modified":"2026-01-20T18:57:44.834757Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T16:55:46.53147Z"}]}}