What is GHSA-c9g9-v2j9-8ffv?

GHSA-c9g9-v2j9-8ffv is a security advisory published by GitHub Security Advisories with High severity. Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The...

Which CVE IDs does GHSA-c9g9-v2j9-8ffv cover?

GHSA-c9g9-v2j9-8ffv covers the following CVE IDs: CVE-2026-6656. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c9g9-v2j9-8ffv?

GHSA-c9g9-v2j9-8ffv has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-c9g9-v2j9-8ffvHighCVSS 7.5

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The...

Vendor

GitHub Security Advisories

Published

July 20, 2026

Last Modified

July 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-6656 →

📋 Description

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks.

The check_password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-6656
https://metacpan.org/release/DRSTEVE/Crypt-Password-0.28/source/lib/Crypt/Password.pm#L190-193
https://rt.cpan.org/Ticket/Display.html?id=180162
https://github.com/advisories/GHSA-c9g9-v2j9-8ffv