CVE-2026-47372

CVE-2026-47372: Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts

Vendor Rrwo

Product Crypt::SaltedHash

Weakness CWE-338

Published May 20, 2026

Last update May 21, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Key dates

02Disclosure timeline

May 20, 2026 CVE published

May 21, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-47372 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/338.html

Related vulnerabilities

04Related CVE

CVE-2025-15618 Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key CVE-2023-24828 Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev CVE-2024-58036 Net::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functions CVE-2025-69217 Coturn has unsafe nonce and relay port randomization due to weak random number generation. CVE-2025-21617 Guzzle OAuth Subscriber has insufficient nonce entropy