CVE-2026-47372: Crypt::SaltedHash for Perl - Predictable Salt Generation (CWE-338)
Crypt::SaltedHash for Perl, in versions through 0.09, generates salts with the built-in rand function, which is predictable and unsuitable for cryptography. The CNA rates the issue as Critical with a CVSS 3.1 base score of 9.1. The record does not list affected or fixed versions in structured form, and no confirmed exploitation appears in the sources consulted.
Overview
Crypt::SaltedHash, a Perl module, is associated with CWE-338, which concerns the use of a cryptographically weak pseudo-random number generator. According to the record, versions through 0.09 use the built-in rand function to produce salts, and that function is predictable and unsuitable for cryptography.
Impact
The CNA-provided CVSS 3.1 base score is 9.1 (Critical), with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact. Predictable salts weaken salted hashing, because salts are meant to be unpredictable. The practical consequences depend on how an application uses the module, which the record does not describe.
Affected products and versions
- Product: Crypt::SaltedHash for Perl.
- Affected versions stated in the description: through 0.09.
- The record's affected list is empty, so no structured version ranges or CPE data are provided.
- The reference list includes a changelog for release 0.10 (MetaCPAN changelog). The record does not explicitly state that this release contains the fix.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00505 with a percentile of 0.41499.
Remediation and mitigation
- Identify systems, Perl projects and build pipelines that depend on Crypt::SaltedHash and record the installed versions.
- Plan an upgrade to a release newer than 0.09, and confirm the fixed release against the maintainer's changelog before deployment.
- Review the referenced commit patch so that code reviewers understand the change.
- Until upgrading is possible, review whether salts generated by affected versions were stored, and consider rehashing credentials when users next authenticate, where the application design allows it.
- Treat a salt generation fix as one step only. Stored hashes produced with weak salts may need additional handling.
Detection guidance
- Inventory Perl dependency manifests and installed module versions across servers, containers and build environments.
- Include the module name and version in software bill of materials reviews.
- Watch for unexpected authentication or account changes in applications that rely on this module, as part of general monitoring.
Limitations of the available information
The record does not provide structured affected or fixed version data, the CWE name, or vendor-independent confirmation of the fixed release. The source status is listed as Deferred. Verify version boundaries and patch availability with the maintainer and the cited references before making decisions.
Frequently asked questions
What is the vulnerability in Crypt::SaltedHash?
According to the record, versions through 0.09 generate salts using the built-in rand function, which is predictable and unsuitable for cryptography.
How severe is CVE-2026-47372?
The CNA-provided CVSS 3.1 base score is 9.1, rated Critical. The record does not include scores from other providers.
Is this vulnerability known to be exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do now?
Identify installations, plan an upgrade to a release newer than 0.09 after confirming the fixed version with the maintainer, and review whether weakly salted credentials need rehashing.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.