by Kastro
Paper/Archive/CVE-2026-12205

CVE-2026-12205

TIMLEGGE Crypt::DSA — Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
32
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 21.5.215 × 204.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical "r". Keys used to sign more than once with an affected version should be considered compromised.

Affected

ProductAffectedFixed inSource
Crypt::DSA< 1.211.21CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refmetacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/source/lib/Crypt/DSA.pm#L47refmetacpan.org/release/TIMLEGGE/Crypt-DSA-1.21/changesrefopenwall.com/lists/oss-security/2026/06/15/4