CVE-2026-6659

CVE-2026-6659: Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts

Vendor Rsavage

Product Crypt::PasswdMD5

Weakness CWE-338

Published May 8, 2026

Last update May 26, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The built-in rand function is predictable, and unsuitable for cryptography.

Key dates

02Disclosure timeline

May 8, 2026 CVE published

May 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-6659 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/338.html

Related vulnerabilities

04Related CVE

CVE-2023-45237 Use of a Weak PseudoRandom Number Generator in EDK II Network Package CVE-2023-28835 Insecure randomness for default password in nextcloud CVE-2026-57082 Net::BitTorrent versions through 2.0.1 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG CVE-2025-40916 Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha text CVE-2021-3678 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdoc