Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts. The _make_salt and _make_salt_bcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply return 16 bytes generated with Perl's built-in rand function. The rand function is unsuitable for cryptographic use. These salts are used for password hashing.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
Perl CPAN CVE-2026-5088: Apache::API::Password versions through 0.5.2 can generate insecure random values for salts https://www.openwall.com/lists/oss-security/2026/04/15/4
Post summary
The note announces CVE‑2026‑5088, describing how Apache::API::Password produces insecure random salts, but provides no PoC, exploit, or patch details.
CVE-2026-5088 Apache::API::Password versions through v0.5.2 for Perl can generate insecure random values for salts. The _make_salt and _make_salt_bcrypt methods will attept to load … https://www.cve.org/CVERecord?id=CVE-2026-5088
Post summary
The text discloses CVE‑2026‑5088, noting that Apache::API::Password versions ≤ 0.5.2 generate weak salts via _make_salt functions, but provides no PoC, exploitation details, or patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jdeguest | apache\ | \ | - | - |