CVE-2026-5088

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5088", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-03-28T19:31:47.729Z", "datePublished": "2026-04-15T07:03:13.742Z", "dateUpdated": "2026-05-01T16:03:43.825Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Apache2-API", "product": "Apache::API::Password", "programFiles": ["lib/Apache2/API.pm"], "programRoutines": [{"name": "Apache2::API::Password::_make_salt"}, {"name": "Apache2::API::Password::_make_salt_bcrypt"}], "repo": "https://gitlab.com/jackdeguest/Apache2-API", "vendor": "JDEGUEST", "versions": [{"lessThanOrEqual": "0.5.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts.\n\nThe _make_salt and _make_salt_bcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply return 16 bytes generated with Perl's built-in rand function.\n\nThe rand function is unsuitable for cryptographic use.\n\nThese salts are used for password hashing."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-01T16:03:43.825Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.3/changes"}, {"tags": ["related"], "url": "https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.2/view/lib/Apache2/API/Password.pod"}, {"tags": ["technical-description"], "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"}, {"url": "https://metacpan.org/pod/Crypt::URandom"}], "solutions": [{"lang": "en", "value": "Upgrade to version v0.5.3 or later, and install Crypt::URandom."}], "source": {"discovery": "UNKNOWN"}, "title": "Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts", "workarounds": [{"lang": "en", "value": "Install Crypt::URandom."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/15/4"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/15/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-15T17:24:20.860Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T11:59:31.300289Z", "id": "CVE-2026-5088", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:05:32.095Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/15/4"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/15/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-15T17:24:20.860Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-5088", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T11:59:31.300289Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T11:59:27.059Z"}}], "cna": {"title": "Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://gitlab.com/jackdeguest/Apache2-API", "vendor": "JDEGUEST", "product": "Apache::API::Password", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.5.2"}], "packageName": "Apache2-API", "programFiles": ["lib/Apache2/API.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Apache2::API::Password::_make_salt"}, {"name": "Apache2::API::Password::_make_salt_bcrypt"}]}], "solutions": [{"lang": "en", "value": "Upgrade to version v0.5.3 or later, and install Crypt::URandom."}], "references": [{"url": "https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.3/changes", "tags": ["release-notes"]}, {"url": "https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.2/view/lib/Apache2/API/Password.pod", "tags": ["related"]}, {"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html", "tags": ["technical-description"]}, {"url": "https://metacpan.org/pod/Crypt::URandom"}], "workarounds": [{"lang": "en", "value": "Install Crypt::URandom."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts.\n\nThe _make_salt and _make_salt_bcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply return 16 bytes generated with Perl's built-in rand function.\n\nThe rand function is unsuitable for cryptographic use.\n\nThese salts are used for password hashing."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-01T16:03:43.825Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5088", "state": "PUBLISHED", "dateUpdated": "2026-05-01T16:03:43.825Z", "dateReserved": "2026-03-28T19:31:47.729Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-04-15T07:03:13.742Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Apache2-API", "product": "Apache::API::Password", "programFiles": ["lib/Apache2/API.pm"], "programRoutines": [{"name": "Apache2::API::Password::_make_salt"}, {"name": "Apache2::API::Password::_make_salt_bcrypt"}], "repo": "https://gitlab.com/jackdeguest/Apache2-API", "vendor": "JDEGUEST", "versions": [{"lessThanOrEqual": "0.5.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jdeguest:apache\\:\\:api\\:\\:password:*:*:*:*:*:perl:*:*", "matchCriteriaId": "C1E70901-982A-4073-9489-06791A187BDB", "versionEndExcluding": "0.5.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts.\n\nThe _make_salt and _make_salt_bcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply return 16 bytes generated with Perl's built-in rand function.\n\nThe rand function is unsuitable for cryptographic use.\n\nThese salts are used for password hashing."}, {"lang": "es", "value": "Las versiones de Apache::API::Password hasta la 0.5.2 para Perl pueden generar valores aleatorios inseguros para las sales.\n\nLos m\u00e9todos _make_salt y _make_salt_bcrypt intentar\u00e1n cargar Crypt::URandom y luego Bytes::Random::Secure para generar bytes aleatorios para la sal. Si esos m\u00f3dulos no est\u00e1n disponibles, simplemente devolver\u00e1 16 bytes generados con la funci\u00f3n rand incorporada de Perl.\n\nLa funci\u00f3n rand no es adecuada para uso criptogr\u00e1fico.\n\nEstas sales se utilizan para el hash de contrase\u00f1as."}], "id": "CVE-2026-5088", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5088", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T11:59:31.300289Z", "version": "2.0.3"}}]}, "published": "2026-04-15T08:16:16.790", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product"], "url": "https://metacpan.org/pod/Crypt::URandom"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product"], "url": "https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.2/view/lib/Apache2/API/Password.pod"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"], "url": "https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.3/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product"], "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/15/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/15/5"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,v0.5.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Apache::API::Password", "source": "cna", "vendor": "JDEGUEST"}, "product": "apache::api::password", "vendor": "jdeguest"}], "created": "2026-04-15T13:49:14.867362+00:00", "updated": "2026-05-02T08:30:26.194155+00:00", "vendors": ["jdeguest", "jdeguest$PRODUCT$apache::api::password"]}