DSA Signing Vulnerability in Crypt::DSA for Perl Software
CVE-2026-14570

7.5HIGH

Key Information:

Vendor

Timlegge

Status
Crypt::dsa
Vendor
CVE Published:
5 July 2026

What is CVE-2026-14570?

The Crypt::DSA library for Perl versions prior to 1.22 contains a significant vulnerability that may compromise private keys. The issue stems from the DSA signing nonce and private key being generated using a biased random number generator. Specifically, the high bit of values produced by the function Crypt::DSA::Util::makerandom is fixed, which creates a non-uniform distribution of generated values. This flaw enables an attacker to recover private keys after collecting a small number of signatures associated with the affected key, leveraging lattice attack techniques. Users of vulnerable versions are strongly advised to generate new keys immediately and upgrade to the latest version to ensure the security of their applications.

Affected Version(s)

Crypt::DSA 0 < 1.22

References

https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.21/sour...
https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.22/diff...
https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.22/changes
release-notes

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.