Executive brief
Crypt::Password is a Perl library used for managing and verifying user passwords. A security flaw in how it compares passwords allows an attacker to potentially guess password hashes by measuring tiny differences in the time it takes for the system to respond. This could lead to unauthorized access if an attacker successfully reconstructs a valid password hash.
Technical details
The Crypt::Password library (versions up to and including 0.28) is vulnerable to an observable timing discrepancy (CWE-208). The 'check_password' method utilizes Perl's built-in 'eq' operator for string comparison, which returns as soon as a mismatch is found. By measuring the time taken for the comparison to fail, a remote attacker can perform a side-channel timing attack to iteratively guess the characters of the underlying password hash. This vulnerability is typically mitigated by using a constant-time comparison function.
Affected products
- DRSTEVE Crypt::Password through 0.28
Timeline
- 2026-07-20: disclosed: CVE-2026-6656 published by NVD