Executive brief
Crypt::SaltedHash is a Perl library used to handle password hashing and validation. Versions up to 0.09 are vulnerable to a timing attack during password verification because they use a standard comparison method that finishes faster if the first characters of a password match. An attacker could potentially use these tiny timing differences to guess valid password hashes, leading to unauthorized account access.
Technical details
The Crypt::SaltedHash library (versions <= 0.09) uses Perl's built-in 'eq' operator for comparing generated hashes against stored hashes in the validate() function. Because 'eq' is not a constant-time comparison operator, it returns as soon as a mismatch is found, creating an observable timing discrepancy (CWE-208). An attacker with the ability to make repeated validation requests can measure these timing differences to perform a side-channel attack and reconstruct the hash byte-by-byte. This issue is resolved in version 0.10 by implementing a secure, constant-time comparison function (_secure_compare).
Affected products
- Perl CPAN Crypt::SaltedHash through 0.09
Timeline
- 2026-05-19: patched: Fixed in version 0.10
- 2026-05-20: disclosed: CVE published to NVD