Nonce Reuse in Crypt::DSA Versions for Perl by TIMLEGGE

CVE-2026-12205

What is CVE-2026-12205?

The Crypt::DSA library versions prior to 1.21 for Perl exhibit a significant security flaw where the nonce used during the signing process is reused across multiple signatures. This issue arises because the library caches the nonce material in the Key object without the necessary clearance after each signing operation. Consequently, utilizing the same Key object to sign multiple messages results in the generation of identical 'r' values, which can lead to the recovery of private keys. Any keys signed with affected versions should be treated as compromised and revoked immediately.

References