What’s Vulnerable › Vulnerabilities

CVE-2026-12205: Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-15 · updated 2026-10-25
• Weakness: CWE-323

Description

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical "r". Keys used to sign more than once with an affected version should be considered compromised.

Affected products

• TIMLEGGE Crypt::DSA: before 1.21 — fixed in 1.21

How to fix

Upgrade to a fixed version: TIMLEGGE Crypt::DSA 1.21. Check the vendor advisory for mitigations.

References

• https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/source/lib/Crypt/DSA.pm#L47
• https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.21/changes
• http://www.openwall.com/lists/oss-security/2026/06/15/4

Get alerted when CVE-2026-12205 or the next vulnerability affects your stack