CVE-2026-47373
High · 7.5CVSS
7.5
EPSS
0.5%
Published
May 20, 2026
CISA due date
—
The record
Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | perl-Crypt-SaltedHash | 0 | 0.110.0-bp160.1.1 |
| openSUSE:Leap 16.0 | perl-Crypt-SysRandom | 0 | 0.7.0-bp160.1.1 |
| openSUSE:Tumbleweed | perl-Crypt-SaltedHash | 0 | 0.110.0-1.1 |
Related vulnerabilities
- CVE-2026-47372 Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for… Also affects perl-Crypt-SaltedHash
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
- CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
- CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208
- CVE-2026-54872 Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2… CWE-208
- CVE-2026-87737 An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. CWE-208
- CVE-2026-84308 phpseclib is a PHP secure communications library. CWE-208