CVE-2026-47372 Details
Description
Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
A vulnerability exists in Crypt::SaltedHash versions through 0.09 for Perl, where the rand function is used to generate salts. This method is predictable and not suitable for cryptographic purposes, leading to potential security risks.
Users can upgrade to Crypt::SaltedHash version 0.10, which addresses this vulnerability by using Crypt::SysRandom to generate salts, ensuring a more secure and unpredictable random value.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 20, 2026CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/robrwo/perl-Crypt-SaltedHash/commit/9b68437d2cd420b819b3a795474c3870338d38d5.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/RRWO/Crypt-SaltedHash-0.10/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/05/20/22 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Crypt::SaltedHash | <= 0.09 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | CVE Modified | CVE |
| May 20, 2026 | New CVE Received | CPANSec |