[<prev] [next>] [day] [month] [year] [list]
Message-ID: <3648aefb-aeb4-4f05-bcb2-fff9f726535c@cpansec.org>
Date: Mon, 13 Apr 2026 23:57:49 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-5086: Crypt::SecretBuffer versions before 0.019 for Perl is
suseceptible to timing attacks
========================================================================
CVE-2026-5086 CPAN Security Group
========================================================================
CVE ID: CVE-2026-5086
Distribution: Crypt-SecretBuffer
Versions: before 0.019
MetaCPAN: https://metacpan.org/dist/Crypt-SecretBuffer
VCS Repo: https://github.com/nrdvana/perl-Crypt-SecretBuffer
Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to
timing attacks
Description
-----------
Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to
timing attacks.
For example, if Crypt::SecretBuffer was used to store and compare
plaintext passwords, then discrepencies in timing could be used to
guess the secret password.
Problem types
-------------
- CWE-208 Observable Timing Discrepancy
Solutions
---------
Upgrade to version 0.019 or later.
References
----------
https://metacpan.org/release/NERDVANA/Crypt-SecretBuffer-0.019/source/Changes
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
