# CVE-2026-6659: Crypt::PasswdMD5 weak PRNG in salt generation

Source: https://junglewise.ai/threats/cve-2026-6659-crypt-passwdmd5-weak-prng-in-salt-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-6659 · Severity: high · CVSS 7.5 · Published 2026-05-08

Crypt::PasswdMD5 is a Perl library used to generate MD5-based password hashes for Unix and Apache authentication. A security flaw was identified where the library uses a predictable random number generator to create password 'salts,' which are meant to protect passwords from being easily cracked. This weakness could allow an attacker to more easily guess or crack user passwords, potentially leading to unauthorized account access.

Vendors: [Perl CPAN](https://junglewise.ai/threats/vendors/perl-cpan).

## Quick answers

**Is CVE-2026-6659 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6659 being exploited in the wild.

**How severe is CVE-2026-6659?** High severity, with a CVSS score of 7.5, published 8 May 2026.

**Which products and versions are affected?** Perl CPAN Crypt::PasswdMD5 through 1.42.

**Is there a fix for CVE-2026-6659?** A patch was published on 2026-05-22: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6659 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6659?** Check whether you run Perl CPAN Crypt::PasswdMD5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Crypt::PasswdMD5 through version 1.42 utilizes Perl's built-in rand() function within the random_md5_salt() subroutine. This function is a cryptographically weak pseudo-random number generator (PRNG) that is predictable and unsuitable for security-sensitive operations like salt generation. An attacker who can predict the salt values can significantly reduce the computational effort required to perform pre-computation or brute-force attacks against password hashes generated by the library. The vulnerability is addressed in version 1.43 by replacing rand() with Crypt::URandom::urandom().

## Affected products

- Ron Savage Crypt::PasswdMD5 through 1.42

## Timeline

- 2026-05-08: disclosed: Vulnerability disclosed on oss-security mailing list
- 2026-05-08: advisory: CVE-2026-6659 published
- 2026-05-22: patched: Fix committed to GitHub repository
- 2026-05-23: other: Version 1.43 released to CPAN

## References

- [https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch](https://github.com/ronsavage/Crypt-PasswdMD5/commit/a2f821637db0296082297aa4b02254ab08f0dc5e.patch)
- [https://github.com/ronsavage/Crypt-PasswdMD5/pull/3](https://github.com/ronsavage/Crypt-PasswdMD5/pull/3)
- [https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm](https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.42/source/lib/Crypt/PasswdMD5.pm)
- [https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes](https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5-1.43/changes)
- [http://www.openwall.com/lists/oss-security/2026/05/08/17](http://www.openwall.com/lists/oss-security/2026/05/08/17)