CVE-2026-5086

CVE-2026-5086: Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks

Vendor Nerdvana

Product Crypt::SecretBuffer

Weakness CWE-208

Published April 13, 2026

Last update April 15, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks. For example, if Crypt::SecretBuffer was used to store and compare plaintext passwords, then discrepencies in timing could be used to guess the secret password.

Key dates

02Disclosure timeline

April 13, 2026 CVE published

April 15, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-5086 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/208.html

Related vulnerabilities

04Related CVE

CVE-2024-36405 Control-flow timing leak in Kyber reference implementation when compiled with Clang 15-18 for -Os, -O1 and other options CVE-2025-48995 SignXML's signature verification with HMAC is vulnerable to a timing attack CVE-2026-33006 Apache HTTP Server: mod_auth_digest timing attack CVE-2026-43514 Apache Tomcat: AJP secret compared in non-constant time CVE-2026-23519 RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz