What’s Vulnerable › Vulnerabilities

CVE-2026-47372: Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-20 · updated 2026-07-20
• Weakness: CWE-338

Description

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Affected products

• RRWO Crypt::SaltedHash: through 0.09

References

• https://github.com/robrwo/perl-Crypt-SaltedHash/commit/9b68437d2cd420b819b3a795474c3870338d38d5.patch
• https://metacpan.org/release/RRWO/Crypt-SaltedHash-0.10/changes
• http://www.openwall.com/lists/oss-security/2026/05/20/22

Get alerted when CVE-2026-47372 or the next vulnerability affects your stack