Timing Attack Vulnerability in Crypt::Password for Perl Software

CVE-2026-6656

What is CVE-2026-6656?

Crypt::Password versions through 0.28 for Perl are vulnerable to timing attacks due to the use of the built-in eq operator in the check_password method. This implementation flaw allows an attacker to exploit timing discrepancies to infer information about the underlying password hash, potentially leading to unauthorized access. It is crucial for users of this library to review their implementations and update to more secure practices to mitigate this risk.

References