CVE-2026-14570: Crypt::DSA Information Disclosure Flaw

CVE-2026-14570 Overview

CVE-2026-14570 affects Crypt::DSA for Perl in versions before 1.22. The module draws Digital Signature Algorithm (DSA) signing nonces and private keys from a biased random generator. Crypt::DSA::Util::makerandom forces the high bit of every returned value to obtain an exactly N-bit integer intended for prime search. When the same routine supplies signing nonces and private keys, the fixed top bit produces non-uniform values suitable for lattice-based key recovery. An attacker who collects a modest number of signatures under an affected key, together with the public key, can reconstruct the private key. The weakness is tracked under [CWE-330: Use of Insufficiently Random Values].

Critical Impact
Any DSA private key generated or used to sign data with Crypt::DSA versions before 1.22 must be considered compromised and rotated.

Affected Products

Crypt::DSA for Perl, all versions prior to 1.22
Perl applications and services that generate DSA keys using Crypt::DSA
Perl applications that produce DSA signatures using Crypt::DSA

Discovery Timeline

2026-07-05 - CVE-2026-14570 published to the National Vulnerability Database (NVD)
2026-07-05 - Public discussion posted to the Openwall OSS Security list
2026-07-06 - Last updated in the NVD database

Technical Details for CVE-2026-14570

Vulnerability Analysis

DSA security depends on two uniformly random values: the long-lived private key x and the per-signature nonce k. Both must be indistinguishable from uniform integers modulo the subgroup order q. In Crypt::DSA versions before 1.22, both values are produced by Crypt::DSA::Util::makerandom, a helper originally designed to generate candidates for prime search. That helper sets the most significant bit of every output so the result is exactly N bits long. Fixing the top bit halves the output space and biases every generated value into the upper half of the range [0, 2^N). When applied to k, each signature leaks roughly one bit of information about the nonce. Given a modest collection of signatures under one key, an attacker can construct a Hidden Number Problem (HNP) lattice and recover the private key x in polynomial time.

Root Cause

The root cause is a semantic mismatch between the intended use of makerandom and its actual callers. The function was written for prime candidate generation, where forcing the high bit is desirable. Reusing it for cryptographic secrets injects a deterministic bias, violating the uniformity assumption of DSA. Version 1.22 replaces the biased draws with unbiased random integers modulo q for both nonce and private key generation.

Attack Vector

An attacker needs only the target public key and a collection of DSA signatures produced under an affected version. Signatures are typically transmitted alongside signed messages and are considered public data, so no privileged access is required. After collecting a sufficient number of signatures, the attacker builds a lattice encoding the fixed high bit of each nonce and solves it using algorithms such as Lenstra-Lenstra-Lovász (LLL) or Block Korkine-Zolotarev (BKZ). The recovered private key permits arbitrary signature forgery under the victim identity. Because the flaw is in random generation rather than in a network endpoint, exploitation is offline once signatures have been gathered.

Verified proof-of-concept code is not published in the referenced advisories, so no exploit snippet is reproduced here. Refer to the MetaCPAN diff between 1.21 and 1.22 for the exact code change.

Detection Methods for CVE-2026-14570

Indicators of Compromise

Installations of Crypt-DSA at versions 1.21 or earlier, verifiable via cpan -D Crypt::DSA or by inspecting MYMETA.json in deployed Perl applications.
DSA public keys or signatures produced by systems that link against the vulnerable Crypt::DSA::Util module.
Long-lived DSA keys that were generated on hosts running the affected Perl module and never rotated.

Detection Strategies

Inventory Perl module versions across servers and developer workstations, flagging any Crypt-DSA release below 1.22.
Audit package manifests, container images, and CI build logs for pinned installs of Crypt-DSA-1.21 or earlier.
Statically test suspect keys by generating signatures in a lab and checking whether the top bit of k is consistently set, which confirms exposure.

Monitoring Recommendations

Watch software composition analysis (SCA) feeds for advisories referencing Crypt::DSA and CWE-330.
Alert on new DSA key material issued from systems that have not yet been patched to Crypt-DSA 1.22.
Log and review DSA signature verifications in application telemetry so that keys pending rotation can be traced end-to-end.

How to Mitigate CVE-2026-14570

Immediate Actions Required

Upgrade Crypt-DSA to version 1.22 or later on every host, container image, and build pipeline.
Treat all DSA private keys previously used with an affected version as compromised, revoke them, and issue replacements.
Re-sign artifacts, tokens, or certificates that relied on the compromised keys once new keys are in place.
Where feasible, migrate away from DSA to modern signature schemes such as Ed25519 or ECDSA over well-vetted curves.

Patch Information

The maintainer released Crypt-DSA 1.22, which changes Crypt::DSA::Util::makerandom behavior so DSA private keys and per-signature nonces are drawn from an unbiased distribution modulo q. Details are documented in the Crypt-DSA 1.22 changelog and the source diff on MetaCPAN.

Workarounds

Disable code paths in your applications that generate DSA keys or signatures with Crypt::DSA until the upgrade is complete.
Replace calls into Crypt::DSA with a maintained cryptographic library that provides uniform random sampling for DSA parameters.
If DSA must remain in use temporarily, generate keys and nonces with a validated cryptographically secure random source and pass them explicitly instead of relying on makerandom.

bash

# Upgrade Crypt-DSA to the fixed release using cpanm
cpanm Crypt::DSA@1.22

# Verify installed version
perl -MCrypt::DSA -e 'print $Crypt::DSA::VERSION, "\n"'