CVE-2026-12205: Crypt::DSA Information Disclosure Issue

CVE-2026-12205 Overview

CVE-2026-12205 is a cryptographic vulnerability in the Perl module Crypt::DSA for versions prior to 1.21. The module reuses the per-signature nonce across multiple Digital Signature Algorithm (DSA) operations performed with the same Key object. The Crypt::DSA::sign function caches nonce material on the Key object and never clears it. As a result, the first call to sign() selects a nonce, and every subsequent call on that object reuses it, producing an identical r value. Two signatures generated with the same nonce permit straightforward recovery of the DSA private key. Any key used to sign more than once with an affected version must be treated as compromised. The weakness is tracked under [CWE-323: Reusing a Nonce, Key Pair in Encryption].

Critical Impact
Attackers who collect two or more signatures from the same Crypt::DSA key can recover the private key and forge arbitrary signatures.

Affected Products

Crypt::DSA for Perl, all versions before 1.21
Perl applications and libraries that depend on Crypt::DSA for signing
Long-lived keys signed multiple times using affected versions

Discovery Timeline

2026-06-15 - CVE-2026-12205 published to the National Vulnerability Database (NVD)
2026-06-15 - Issue discussed on the OpenWall OSS-Security mailing list
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2026-12205

Vulnerability Analysis

DSA signatures depend on a secret, uniformly random per-signature value k (the nonce). The signature pair (r, s) is computed as r = (g^k mod p) mod q and s = k^-1 * (H(m) + x*r) mod q, where x is the private key. The security of DSA collapses entirely if k repeats across two signatures produced with the same key. Given two signatures (r, s1) and (r, s2) over distinct messages m1 and m2, an attacker recovers k = (H(m1) - H(m2)) * (s1 - s2)^-1 mod q and then x = (s1*k - H(m1)) * r^-1 mod q. The recovered x is the full private key. This places CVE-2026-12205 in the cryptographic vulnerability class of insecure nonce handling.

Root Cause

The defect lies in Crypt::DSA::sign within lib/Crypt/DSA.pm. The function generates the nonce on first use and caches it as an attribute on the Key object. The code path never invalidates or regenerates the cached value before subsequent signing operations. Every call to sign() on the same Key instance therefore consumes the same k, yielding the same r and exposing the linear relationship that leaks x. See the MetaCPAN Crypt-DSA 1.20 source for the affected logic.

Attack Vector

Exploitation is passive and network-reachable. An attacker who observes two or more signatures produced by the same long-lived Crypt::DSA key — for example, from signed messages, software releases, authentication tokens, or protocol handshakes — can derive the private key offline. No privileges, user interaction, or access to the host running the Perl process are required. Any system holding artifacts signed by an affected key should be assumed exposed.

No verified public exploit code is referenced in the CVE data; the mathematical recovery from nonce reuse in DSA is, however, well documented in cryptographic literature.

Detection Methods for CVE-2026-12205

Indicators of Compromise

Two or more DSA signatures produced by the same key share an identical r value.
Presence of Crypt::DSA at a version below 1.21 in installed Perl module inventories (cpan -l, corelist, or perldoc -l Crypt::DSA).
Application logs showing repeated signing operations against the same in-memory Key object.

Detection Strategies

Inventory all Perl environments and identify hosts with Crypt::DSA versions earlier than 1.21.
Parse stored DSA signatures from logs, code-signing artifacts, or protocol captures and flag duplicate r components for the same public key.
Review source code for patterns that instantiate a Crypt::DSA::Key once and call sign() multiple times during the object lifetime.

Monitoring Recommendations

Monitor package management telemetry for installations or updates of Crypt::DSA and alert when versions below 1.21 are introduced.
Track outbound and stored signatures for keys known to have been used by applications previously running affected releases.
Audit certificate authorities, code-signing pipelines, and authentication services that depend on Perl DSA signing for repeated r values.

How to Mitigate CVE-2026-12205

Immediate Actions Required

Upgrade Crypt::DSA to version 1.21 or later on every host where it is installed.
Treat any DSA private key signed more than once with an affected version as compromised, revoke it, and issue a replacement.
Re-sign or re-issue artifacts (releases, certificates, tokens) that were authenticated with potentially compromised keys.
Search historical signature stores for duplicate r values to scope exposure.

Patch Information

The maintainer addressed the issue in Crypt::DSA version 1.21. The release notes are available in the MetaCPAN Crypt-DSA 1.21 change log. Install the fixed version with cpan Crypt::DSA or via the distribution's package manager. Additional background is available on the OpenWall OSS-Security discussion.

Workarounds

Instantiate a fresh Crypt::DSA::Key object for each signing operation when upgrading is not immediately possible.
Migrate signing workloads to a maintained cryptographic library such as Crypt::OpenSSL::DSA or switch to deterministic ECDSA (RFC 6979) implementations.
Restrict the use of any DSA key under affected versions to a single signature before destroying the object.

bash

# Upgrade Crypt::DSA to a fixed release
cpan install Crypt::DSA~">=1.21"

# Verify the installed version
perl -MCrypt::DSA -e 'print "$Crypt::DSA::VERSION\n"'