CVE-2026-16235 Overview
CVE-2026-16235 affects Crypt::Password versions through 0.28 for Perl. The module generates insecure random values when producing salts for password hashing. It relies on the built-in Perl rand function, which is not cryptographically secure and produces predictable output.
The weakness is classified under CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). Attackers who can predict salt values can precompute hashes or accelerate offline password cracking against stored credentials.
Critical Impact
Predictable salts undermine password hash storage, allowing attackers to precompute rainbow tables or reduce brute-force cost against credentials protected by Crypt::Password.
Affected Products
- Crypt::Password Perl module versions through 0.28
- Perl applications depending on Crypt::Password for credential hashing
- Downstream distributions bundling vulnerable Crypt::Password releases
Discovery Timeline
- 2026-07-20 - CVE CVE-2026-16235 published to NVD
- 2026-07-20 - Public discussion posted to the OpenWall OSS-Security list
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-16235
Vulnerability Analysis
The vulnerability sits in the salt generation routine of Crypt::Password. Salt bytes are produced by iterating over calls to Perl's built-in rand function. This function returns pseudo-random values from a non-cryptographic generator seeded from limited entropy. The output is deterministic once the seed is known or guessed.
Salts exist to defeat precomputed hash attacks and to force per-account brute-force work. When salts are predictable, both properties collapse. An attacker who recovers a password database can enumerate likely salts, generate candidate hashes, and match them against stored values at scale.
The affected code path is documented in the MetaCPAN Crypt-Password source. The routine constructs the salt in-process without invoking a cryptographically secure source such as /dev/urandom, Crypt::URandom, or Bytes::Random::Secure.
Root Cause
The root cause is use of a non-cryptographic PRNG for a security-sensitive value. Perl's rand is designed for statistical sampling, not for cryptographic entropy. Its internal state is small, and its seeding is predictable across processes started in close succession.
Attack Vector
An attacker who obtains a hashed password store can predict the salts used by the vulnerable module. The attacker precomputes candidate hashes against a wordlist or leaked credential corpus. Matching salts to stored hashes recovers plaintext passwords far faster than a properly salted deployment would allow.
The vulnerability mechanism is described in the OpenWall OSS-Security discussion. No exploitation code is required beyond standard offline cracking tooling once salt prediction is applied.
Detection Methods for CVE-2026-16235
Indicators of Compromise
- Presence of Crypt::Password version 0.28 or earlier in the Perl module inventory (cpan -l or corelist output).
- Application logs showing password hash generation without calls to Crypt::URandom, Crypt::Random, or /dev/urandom.
- Repeated or low-entropy salt values across independently created accounts in the credential store.
Detection Strategies
- Inventory Perl dependencies across build systems and production hosts, flagging any Crypt::Password release at or below 0.28.
- Audit source code for direct calls to Perl rand in security-sensitive functions, particularly around salt or token generation.
- Sample stored password records and analyze salt distribution for signs of low entropy or repetition.
Monitoring Recommendations
- Monitor package management activity for installation of vulnerable Crypt::Password versions from CPAN mirrors.
- Alert on unusual bulk read access to credential tables or password stores.
- Track authentication anomalies such as bursts of successful logins that may indicate credentials recovered through offline cracking.
How to Mitigate CVE-2026-16235
Immediate Actions Required
- Identify all applications using Crypt::Password and confirm installed versions across development, staging, and production environments.
- Replace Crypt::Password salt generation with a cryptographically secure source such as Crypt::URandom or Bytes::Random::Secure.
- Force password resets for accounts whose hashes were generated with the vulnerable module, since existing salts remain predictable.
Patch Information
At the time of publication, no fixed release of Crypt::Password is referenced in the NVD entry. Consult the MetaCPAN Crypt-Password page for upstream status and monitor the OpenWall OSS-Security thread for remediation guidance.
Workarounds
- Migrate to a maintained password hashing library such as Crypt::Argon2 or Crypt::Bcrypt, which handle salt generation using secure entropy sources.
- Wrap or monkey-patch the salt generation function to draw from /dev/urandom until an upstream fix is published.
- Increase password hashing work factors and enforce strong password policies to raise the cost of offline cracking against legacy hashes.
# Configuration example: replace Crypt::Password usage with Crypt::Argon2
cpanm Crypt::Argon2
# In application code, generate hashes via argon2id_pass() instead of Crypt::Password::password()
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
