CVE-2026-47372: Perl Crypt::SaltedHash Weak Salt Flaw

CVE-2026-47372 Overview

CVE-2026-47372 affects Crypt::SaltedHash versions through 0.09 for Perl. The module generates salts using Perl's built-in rand function, which is not cryptographically secure. Attackers who can predict the pseudo-random number generator state can derive salts used by the module. Predictable salts undermine the security of password hashes by enabling precomputed attacks against multiple accounts and reducing the cost of brute-force operations. The issue is tracked under CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator. Version 0.10 of the module replaces rand with Crypt::SysRandom to source salts from the operating system's secure randomness facility.

Critical Impact

Predictable salts in Crypt::SaltedHash weaken stored password hashes and enable accelerated offline password cracking against systems relying on this module.

Affected Products

• Crypt::SaltedHash Perl module versions through 0.09
• Perl applications that depend on Crypt::SaltedHash for password storage
• Downstream CPAN distributions bundling vulnerable versions of Crypt::SaltedHash

Discovery Timeline

• 2026-05-20 - CVE-2026-47372 published to NVD
• 2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-47372

Vulnerability Analysis

The Crypt::SaltedHash module produces salted password digests for use with hashing algorithms such as SHA-1, SHA-256, and SHA-512. Salts are intended to be unique, unpredictable values that prevent precomputed rainbow table attacks and ensure identical passwords produce distinct hashes. In versions through 0.09, the module generates each byte of the salt using Perl's core rand function. Perl's rand is a deterministic pseudo-random number generator seeded from limited entropy sources. It is not designed for cryptographic use. An attacker who observes salts produced over time, or who can reproduce the seeded state, can predict future or past salts produced by the same process. This converts a per-password computation problem into a feasible offline attack against many accounts simultaneously.

Root Cause

The root cause is the selection of a non-cryptographic random source for security-sensitive material. The module called rand in its salt-generation routine instead of drawing bytes from a cryptographically secure source such as /dev/urandom, getrandom(2), or a vetted CSPRNG wrapper. This pattern is classified under CWE-338.

Attack Vector

Exploitation requires access to one or more password hashes generated by the affected module. An attacker performs offline analysis to recover the PRNG state, predicts the salts used for stored hashes, and runs dictionary or brute-force attacks against the now-predictable salt and hash pairs. The vulnerability does not yield direct code execution but degrades the strength of credential storage.

// Patch excerpt: dist.ini prerequisites updated to require Crypt::SysRandom
 [Prereqs]
+Crypt::SysRandom           = 0
 Digest                     = 0
 MIME::Base64               = 0
+POSIX                      = 0

 [Prereqs / TestRequires]
 Test::More                 = 0

Source: GitHub commit 9b68437d

Detection Methods for CVE-2026-47372

Indicators of Compromise

• Installed Crypt::SaltedHash versions at or below 0.09 in Perl @INC paths or CPAN manifests.
• Application dependency files (cpanfile, Makefile.PL, dist.ini) referencing Crypt::SaltedHash without a minimum version of 0.10.
• Stored password records produced by the module that share statistically improbable salt patterns across user accounts.

Detection Strategies

• Inventory Perl modules across servers using cpan -l or perldoc -l Crypt::SaltedHash and flag versions below 0.10.
• Scan source repositories and container images for use Crypt::SaltedHash statements and verify the resolved module version.
• Audit password storage tables for salt entropy by sampling and analyzing salt value distributions.

Monitoring Recommendations

• Track CPAN dependency updates through software composition analysis tooling and alert on installations of Crypt::SaltedHash below version 0.10.
• Monitor application build pipelines to fail builds that pin vulnerable Crypt::SaltedHash versions.
• Log and alert on bulk read access to credential stores that could indicate hash exfiltration for offline cracking.

How to Mitigate CVE-2026-47372

Immediate Actions Required

• Upgrade Crypt::SaltedHash to version 0.10 or later on all systems where the module is installed.
• Rotate user passwords or force password resets for accounts whose hashes were generated using vulnerable versions.
• Rehash existing password records using the patched module to replace predictable salts with cryptographically secure values.

Patch Information

The maintainer released Crypt::SaltedHash version 0.10, which adds Crypt::SysRandom as a prerequisite and uses the system randomness source to generate salts. The fix is documented in the MetaCPAN release changes and applied in GitHub commit 9b68437d. Additional discussion is available on the OpenWall oss-security list.

// Changes file entry from the security patch
     - Updated copyright year.
     - Minimum Perl version is v5.6.0
     - Added missing prerequisite
+    - Security: Use system randomness source to generate the salt CVE-2026-47372

 0.09 2013-07-30
     - add Test::Fatal test requires

Source: GitHub commit 9b68437d

Workarounds

• Replace direct calls to Crypt::SaltedHash salt generation with code that draws salt bytes from Crypt::SysRandom, Crypt::URandom, or /dev/urandom until upgrading is possible.
• Migrate credential storage to a modern password hashing algorithm such as Argon2, bcrypt, or scrypt via Crypt::Argon2 or Crypt::Eksblowfish::Bcrypt.
• Restrict filesystem and database permissions on credential stores to limit hash exposure to offline attackers.

# Upgrade Crypt::SaltedHash to the patched release
cpanm Crypt::SaltedHash@0.10

# Verify the installed version
perl -MCrypt::SaltedHash -e 'print $Crypt::SaltedHash::VERSION, "\n"'