CVE-2026-6656
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jul 20, 2026
CISA due date
—
The record
Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63410 secp256k1-native is a native C secp256k1 implementation for Ruby. CWE-208
- CVE-2026-62860 Picsou is a self-hosted personal finance dashboard. CWE-208
- CVE-2026-93434 An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process… CWE-208
- CVE-2026-65630 Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a… CWE-208
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
- CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
- CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208