# CVE-2026-8700: Perl Crypt::DSA insufficient entropy in seed generation

Source: https://junglewise.ai/threats/cve-2026-8700-perl-crypt-dsa-insufficient-entropy-in-seed-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-8700 · Severity: info · CVSS 0 · Published 2026-05-15

The Crypt::DSA library for Perl, which is used to implement Digital Signature Algorithm (DSA) security, was found to use a weak method for generating security seeds. Because it relied on a predictable random number generator, an attacker could potentially guess the keys used to sign data. This could allow unauthorized parties to forge digital signatures, compromising the authenticity and integrity of secure communications.

Technologies: [Perl CPAN Crypt::DSA](https://junglewise.ai/threats/technologies/crypt-dsa). Vendors: [Perl CPAN](https://junglewise.ai/threats/vendors/perl-cpan).

## Quick answers

**Is CVE-2026-8700 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8700 being exploited in the wild.

**How severe is CVE-2026-8700?** Informational severity, with a CVSS score of 0, published 15 May 2026.

**Which products and versions are affected?** Perl CPAN Crypt::DSA versions before 1.20.

**Is there a fix for CVE-2026-8700?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8700 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8700?** Check whether you run Perl CPAN Crypt::DSA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Crypt::DSA versions prior to 1.20 utilize Perl's built-in 'rand' function to generate seeds for DSA key generation. This function is a pseudo-random number generator (PRNG) that is not cryptographically secure, leading to insufficient entropy (CWE-331). An attacker who can predict the PRNG state may be able to recover private keys or forge digital signatures. The vulnerability is addressed in version 1.20 by migrating to a more secure entropy source. No authentication is required to exploit the resulting weak signatures if they are used in network-facing applications.

## Affected products

- Perl CPAN Crypt::DSA versions before 1.20

## Timeline

- 2026-05-15: disclosed
- 2026-05-15: advisory

## References

- [https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/changes](https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/changes)
- [https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/diff/TIMLEGGE/Crypt-DSA-1.19](https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/diff/TIMLEGGE/Crypt-DSA-1.19)

## Related threats

- [Perl Crypt::DSA private key recovery via nonce reuse](https://junglewise.ai/threats/cve-2026-12205-perl-crypt-dsa-private-key-recovery-via-nonce-reuse)