CVE-2026-5086

HIGH

Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks

Title source: cna
STIX 2.1

Description

Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks. For example, if Crypt::SecretBuffer was used to store and compare plaintext passwords, then discrepencies in timing could be used to guess the secret password.

References (2)

Scores

CVSS v3 7.5
EPSS 0.0001
EPSS Percentile 2.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-208
Status published
Products (1)
NERDVANA/Crypt::SecretBuffer < 0.019
Published Apr 13, 2026
Tracked Since Apr 14, 2026