CVE catalog

CVE-2026-47373

Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash

[CVE catalog]

Severity
High · CVSS 7.5
Published
Source
[NVD] · [CVE record]
EPSS
0.39% · Oct 25, 2026

Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibcrypt-saltedhash-perlsid0.12-1fixed
Debianlibcrypt-saltedhash-perlforky0.12-1fixed
Debianlibcrypt-saltedhash-perltrixie0.09-3vulnerable
Debianlibcrypt-saltedhash-perlbookworm0.09-3vulnerable
Cpelibcrypt-saltedhash-perlNot reportedNot reportedvulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibcrypt-saltedhash-perlsourcesid0.11-1not yet assignedNot reported[1137253]
Debianlibcrypt-saltedhash-perlsourceforky0.11-1not yet assignedNot reported[1137253]
Debianlibcrypt-saltedhash-perlsourcetrixie(unfixed)not yet assignedNot reported[1137253]
Debianlibcrypt-saltedhash-perlsourcebookworm(unfixed)not yet assignedNot reported[1137253]

[Debian bug #1137253]

Notes

[trixie] libcrypt-saltedhash-perl: Minor issue [bookworm] libcrypt-saltedhash-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libcrypt-saltedhash-perl]Affected
    Details (2)

    • 0.09-3 · all · bookworm

      Affected

      nvd · libcrypt-saltedhash-perl · debian · bookworm; nvd · libcrypt-saltedhash-perl · debian · 12

    • 0.09-3 · all · bookworm

      Affected

      nvd · libcrypt-saltedhash-perl · debian · bookworm; nvd · libcrypt-saltedhash-perl · debian · 12

[Debian 13 (Trixie)]

  • [libcrypt-saltedhash-perl]Affected
    Details (2)

    • 0.09-3 · all · trixie

      Affected

      nvd · libcrypt-saltedhash-perl · debian · 13

    • 0.09-3 · all · trixie

      Affected

      nvd · libcrypt-saltedhash-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]