CVE-2026-6656

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks.

The check_password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-208

Affected software

No affected versions have been published.

Timeline

Published
Jul 20, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-665639.8Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.CVE-2026-665649.8Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.CVE-2026-665659.8Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.CVE-2026-665668.1Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.CVE-2026-665679.8Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.CVE-2026-665689.8Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.CVE-2026-665699.8Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.CVE-2026-66578.8A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_CVE-2026-665717.1Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.CVE-2026-665726.5Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.CVE-2026-665736.5Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.CVE-2026-665746.5Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
CVE-2026-6656: High severity, CVSS 7.5 | Vulnix