Quick answers
- Is CVE-2026-12205 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12205 being exploited in the wild.
- How severe is CVE-2026-12205?
- Informational severity, with a CVSS score of 0, published 15 June 2026.
- Which products and versions are affected?
- Perl CPAN Crypt::DSA < 1.21.
- Is there a fix for CVE-2026-12205?
- A patch was published on 2026-06-14: Version 1.21 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-12205 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-12205?
- Check whether you run Perl CPAN Crypt::DSA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Crypt::DSA::sign function in versions prior to 1.21 caches the per-signature nonce material (k) within the Key object and fails to clear or regenerate it for subsequent operations. As a result, the first call to sign() generates a nonce that is reused for every subsequent signature made with that same object, producing an identical 'r' value. In DSA, reusing a nonce across different messages allows an observer to mathematically derive the private key. This is classified as CWE-323 (Reusing a Nonce). Users should upgrade to version 1.21, which ensures a fresh nonce is generated for every signature, and revoke any keys used with vulnerable versions.
Affected products
- Perl CPAN Crypt::DSA < 1.21
Timeline
- 2026-05-16: other: Maintainer contacted
- 2026-06-14: patched: Version 1.21 released
- 2026-06-15: disclosed: Public advisory released