# CVE-2026-12205: Perl Crypt::DSA private key recovery via nonce reuse

Source: https://junglewise.ai/threats/cve-2026-12205-perl-crypt-dsa-private-key-recovery-via-nonce-reuse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-12205 · Severity: info · CVSS 0 · Published 2026-06-15

A security flaw in the Crypt::DSA Perl library allows attackers to recover a user's private encryption key. This occurs because the library incorrectly reuses a secret number (nonce) when creating digital signatures, which is a fundamental cryptographic error. If a private key was used to sign more than one document using an affected version of this software, that key must be considered stolen and should be revoked immediately.

Technologies: [Perl CPAN Crypt::DSA](https://junglewise.ai/threats/technologies/crypt-dsa). Vendors: [Perl CPAN](https://junglewise.ai/threats/vendors/perl-cpan).

## Quick answers

**Is CVE-2026-12205 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12205 being exploited in the wild.

**How severe is CVE-2026-12205?** Informational severity, with a CVSS score of 0, published 15 June 2026.

**Which products and versions are affected?** Perl CPAN Crypt::DSA < 1.21.

**Is there a fix for CVE-2026-12205?** A patch was published on 2026-06-14: Version 1.21 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12205 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-12205?** Check whether you run Perl CPAN Crypt::DSA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Crypt::DSA::sign function in versions prior to 1.21 caches the per-signature nonce material (k) within the Key object and fails to clear or regenerate it for subsequent operations. As a result, the first call to sign() generates a nonce that is reused for every subsequent signature made with that same object, producing an identical 'r' value. In DSA, reusing a nonce across different messages allows an observer to mathematically derive the private key. This is classified as CWE-323 (Reusing a Nonce). Users should upgrade to version 1.21, which ensures a fresh nonce is generated for every signature, and revoke any keys used with vulnerable versions.

## Affected products

- Perl CPAN Crypt::DSA < 1.21

## Timeline

- 2026-05-16: other: Maintainer contacted
- 2026-06-14: patched: Version 1.21 released
- 2026-06-15: disclosed: Public advisory released

## References

- [https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/source/lib/Crypt/DSA.pm](https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/source/lib/Crypt/DSA.pm)
- [https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.21/changes](https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.21/changes)
- [http://www.openwall.com/lists/oss-security/2026/06/15/4](http://www.openwall.com/lists/oss-security/2026/06/15/4)

## Related threats

- [Perl Crypt::DSA insufficient entropy in seed generation](https://junglewise.ai/threats/cve-2026-8700-perl-crypt-dsa-insufficient-entropy-in-seed-generation)