CVE catalog

CVE-2026-16235

DEBIAN-CVE-2026-16235

Severity: Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Jul 20, 2026, 7:16:37 AM UTC
Updated: Sep 14, 2026, 5:02:31 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.55% · Oct 25, 2026

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libcrypt-password-perl	14	`0.28-1`	vulnerable
Debian	libcrypt-password-perl	14	`0.28-2`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 23, 2026, 9:44:05 PM UTC

References

[http://www.openwall.com/lists/oss-security/2026/07/20/3]
[https://metacpan.org/release/DRSTEVE/Crypt-Password-0.28/source/lib/Crypt/Password.pm#L306-309]
[https://nvd.nist.gov/vuln/detail/CVE-2026-16235]
[https://osv.dev/vulnerability/DEBIAN-CVE-2026-16235]

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]