CVE-2026-5086

HIGH 7.5CVE-2026-5086 · Published 13/04/2026 · updated 26/10/2026

In short

CVE-2026-5086 is a HIGH (CVSS 7.5) vulnerability affecting crypt (nerdvana).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.1% of all vulnerabilities.
Fix: update to 0.019 or later.

Package	Affected versions	Patched versions
crypt nerdvana	`< 0.019`	`0.019`

Description

Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks. For example, if Crypt::SecretBuffer was used to store and compare plaintext passwords, then discrepencies in timing could be used to guess the secret password.

References

metacpan.org/release/NERDVANA/Crypt-SecretBuffer-0.019/source/Changes · Product
openwall.com/lists/oss-security/2026/04/13/12 · Mailing List

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free