Is CVE-2026-14570 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14570 being exploited in the wild.

How severe is CVE-2026-14570?

Informational severity, with a CVSS score of 0, published 5 July 2026.

Which products and versions are affected?

TIMLEGGE (CPAN) Crypt::DSA < 1.22.

Is there a fix for CVE-2026-14570?

A patch was published on 2026-07-03: Version 1.22 released to fix the bias issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14570 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14570?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14570: Crypt::DSA biased random number generation in makerandom

Q: Is there a fix for CVE-2026-14570?

A patch was published on 2026-07-03: Version 1.22 released to fix the bias issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-14570 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-14570?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14570 · Severity: info · CVSS 0 · Published 2026-07-05

Crypt::DSA is a Perl library used to generate digital signatures for verifying the authenticity of data. A flaw in how the library generates random numbers means that the secret keys used for these signatures are not truly random. An attacker who observes a small number of signatures can use mathematical techniques to recover the private key, allowing them to forge signatures or impersonate the legitimate owner.

Quick answers

Is CVE-2026-14570 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14570 being exploited in the wild.
How severe is CVE-2026-14570?: Informational severity, with a CVSS score of 0, published 5 July 2026.
Which products and versions are affected?: TIMLEGGE (CPAN) Crypt::DSA < 1.22.
Is there a fix for CVE-2026-14570?: A patch was published on 2026-07-03: Version 1.22 released to fix the bias issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14570 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14570?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Crypt::DSA::Util::makerandom function, used for generating both the DSA signing nonce (k) and the private key, contains a modulo bias. Specifically, the function forces the high bit of every returned value to be set to ensure an exactly N-bit integer for prime searches. This lack of uniformity results in a fixed top bit, producing insecure values. An attacker who collects a modest number of signatures (potentially hundreds) generated with an affected key can perform a lattice-based attack to recover the full private key. Users should upgrade to version 1.22 and generate new keys, as existing keys generated or used with vulnerable versions are compromised.

Affected products

TIMLEGGE (CPAN) Crypt::DSA < 1.22

Timeline

2026-07-03: patched: Version 1.22 released to fix the bias issue.
2026-07-05: disclosed: CVE-2026-14570 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.