High severity7.5NVD Advisory· Published Apr 15, 2026· Updated May 6, 2026
CVE-2026-5088
CVE-2026-5088
Description
Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts.
The _make_salt and _make_salt_bcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply return 16 bytes generated with Perl's built-in rand function.
The rand function is unsuitable for cryptographic use.
These salts are used for password hashing.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- www.openwall.com/lists/oss-security/2026/04/15/4nvdMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2026/04/15/5nvdMailing ListThird Party Advisory
- metacpan.org/pod/Crypt::URandomnvdProduct
- metacpan.org/release/JDEGUEST/Apache2-API-v0.5.2/view/lib/Apache2/API/Password.podnvdProduct
- metacpan.org/release/JDEGUEST/Apache2-API-v0.5.3/changesnvdRelease Notes
- security.metacpan.org/docs/guides/random-data-for-security.htmlnvdProduct
News mentions
0No linked articles in our index yet.