CVE-2026-47373: high-severity vulnerability in RRWO Crypt::SaltedHash
Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Crypt::SaltedHash versions up to 0.09 use a comparison method that takes slightly different times depending on when characters match, allowing attackers to guess the password hash through timing analysis.
The library employs Perl's standard eq operator for hash comparison, which exhibits variable execution time based on string matching positions. An attacker can measure response times across multiple attempts to infer the correct hash value byte-by-byte, bypassing the salt's protective mechanism.
In the same product, most dangerous first.