CVE-2026-41564Disclosure(dcit / cryptx)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking. The Crypt::PK::RSA, Crypt::PK::DSA, Crypt::PK::DH, Crypt::PK::ECC, Crypt::PK::Ed25519 and Crypt::PK::X25519 modules seed a per-object PRNG state in their constructors and reuse it without fork detection. A Crypt::PK::* object created before `fork()` shares byte-identical PRNG state with every child process, and any randomized operation they perform can produce identical output, including key generation. Two ECDSA or DSA signatures from different processes are enough to recover the signing private key through nonce-reuse key recovery. This affects preforking services such as the Starman web server, where a Crypt::PK::* object loaded at startup is inherited by every worker process.

dcit CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/DCIT/perl-CryptX/commit/9a1dd3e0c27d68e32450be5538b864c2b115ee15.patch

Vendor / third-party advisories

Other references

https://metacpan.org/release/MIK/CryptX-0.088

Weakness type (CWE)

CWE-335CWE-338

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

cryptx

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-04-23); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

dcit

Products

cryptx

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets4 URLs

By indicator

Full discourse2 posts

Open Source Security mailing list@oss_security164d
Disclosure
Perl CPAN CVE-2017-20230: Storable stack buffer overflow https://www.openwall.com/lists/oss-security/2026/04/21/5 CVE-2025-15638: Net::Dropbear contains vulnerable libtomcrypt https://www.openwall.com/lists/oss-security/2026/04/21/6 CVE-2026-41564: CryptX did not reseed the Crypt::PK PRNG state after forking https://www.openwall.com/lists/oss-security/2026/04/23/2
Post summary
The post lists three newly disclosed Perl CPAN CVEs with brief vulnerability descriptions and links to the corresponding Openwall advisory emails.
000501.0K
4.7K followersView on X
CVE@CVEnew168d
Disclosure
CVE-2026-41564 CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking. The Crypt::PK::RSA, Crypt::PK::DSA, Crypt::PK::DH, Crypt::PK::ECC, Crypt:… https://www.cve.org/CVERecord?id=CVE-2026-41564
Post summary
The text describes a flaw in CryptX <0.088 for Perl where the Crypt::PK PRNG is not reseeded after forking, affecting RSA, DSA, DH, and ECC modules.
0000052
57.2K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	dcit	cryptx	-	perl	-

Explore more

Back to dashboard dcit CVEs cryptx vulnerabilities