CVE catalog

CVE-2025-40920

libcatalyst-authentication-credential-http-perl: CVE-2025-40920

[CVE catalog]

Severity
High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.44% · Oct 25, 2026

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating UUIDs. * Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562. * The nonces should be generated from a strong cryptographic source, as per RFC 7616.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibcatalyst-authentication-credential-http-perlsid1.019-1fixed
Debianlibcatalyst-authentication-credential-http-perlforky1.019-1fixed
Debianlibcatalyst-authentication-credential-http-perltrixie1.018-3vulnerable
Debianlibcatalyst-authentication-credential-http-perlbookworm1.018-2vulnerable
Ubuntulibcatalyst-authentication-credential-http-perl16.041.016-2vulnerable
Ubuntulibcatalyst-authentication-credential-http-perl18.041.016-3vulnerable
Ubuntulibcatalyst-authentication-credential-http-perl18.041.018-1vulnerable
Ubuntulibcatalyst-authentication-credential-http-perl20.041.018-1vulnerable
Ubuntulibcatalyst-authentication-credential-http-perl22.041.018-1vulnerable
Ubuntulibcatalyst-authentication-credential-http-perl24.041.018-2vulnerable
Ubuntulibcatalyst-authentication-credential-http-perl24.041.018-3vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibcatalyst-authentication-credential-http-perlsourcesid1.018-4not yet assignedNot reported[1110887]
Debianlibcatalyst-authentication-credential-http-perlsourceforky1.018-4not yet assignedNot reported[1110887]
Debianlibcatalyst-authentication-credential-http-perlsourcetrixie(unfixed)not yet assignedNot reported[1110887]
Debianlibcatalyst-authentication-credential-http-perlsourcebookworm(unfixed)not yet assignedNot reported[1110887]

[Debian bug #1110887]

Notes

[trixie] libcatalyst-authentication-credential-http-perl: Minor issue [bookworm] libcatalyst-authentication-credential-http-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libcatalyst-authentication-credential-http-perl]Affected
    Details (2)

    • 1.018-2 · all · bookworm

      Affected

      dsa · libcatalyst-authentication-credential-http-perl · debian · bookworm; dsa · libcatalyst-authentication-credential-http-perl · debian · 12

    • 1.018-2 · all · bookworm

      Affected

      dsa · libcatalyst-authentication-credential-http-perl · debian · bookworm; dsa · libcatalyst-authentication-credential-http-perl · debian · 12

[Debian 13 (Trixie)]

  • [libcatalyst-authentication-credential-http-perl]Affected
    Details (2)

    • 1.018-3 · all · trixie

      Affected

      dsa · libcatalyst-authentication-credential-http-perl · debian · 13

    • 1.018-3 · all · trixie

      Affected

      dsa · libcatalyst-authentication-credential-http-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]