========================================================================
CVE-2026-16235                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-16235
   Distribution:  Crypt-Password
       Versions:  through 0.28

       MetaCPAN:  https://metacpan.org/dist/Crypt-Password

Crypt::Password versions through 0.28 for Perl generate insecure random
values for salts

Description
-----------
Crypt::Password versions through 0.28 for Perl generate insecure random
values for salts.

These versions use the built-in rand function, which is predictable and
unsuitable for cryptography.

Problem types
-------------
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
   (PRNG)

Workarounds
-----------
Users can generate a salt manually using a module such as
Crypt::URandom::Token, and pass the salt directly to the password and
crypt_password methods.

This module has not been updated since 2012.

Users should migrate to an alternative solution.

References
----------
https://metacpan.org/release/DRSTEVE/Crypt-Password-0.28/source/lib/Crypt/Password.pm#L306-309