CVE-2026-5086 - Vulnerability Details - OpenCVE

Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks. For example, if Crypt::SecretBuffer was used to store and compare plaintext passwords, then discrepencies in timing could be used to guess the secret password.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Nerdvana	Crypt::secretbuffer

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/04/13/12
https://metacpan.org/release/NERDVANA/Crypt-SecretBuffer-0.019/source/Changes

History

Wed, 15 Apr 2026 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 14 Apr 2026 16:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Nerdvana Nerdvana crypt::secretbuffer
Vendors & Products		Nerdvana Nerdvana crypt::secretbuffer

Tue, 14 Apr 2026 02:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/04/13/12

Mon, 13 Apr 2026 23:00:00 +0000

Type	Values Removed	Values Added
Description		Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks. For example, if Crypt::SecretBuffer was used to store and compare plaintext passwords, then discrepencies in timing could be used to guess the secret password.
Title		Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks
Weaknesses		CWE-208
References		https://metacpan.org/release/NERDVANA/Crypt-SecretBuffer-0.019/source/Changes

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2026-04-13T22:54:53.724Z

Updated: 2026-04-15T20:03:28.442Z

Reserved: 2026-03-28T19:22:27.564Z

Link: CVE-2026-5086

Vulnrichment

Updated: 2026-04-14T01:34:38.681Z

NVD

Status : Received

Published: 2026-04-13T23:16:27.990

Modified: 2026-04-15T20:16:37.690

Link: CVE-2026-5086

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5086", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-03-28T19:22:27.564Z", "datePublished": "2026-04-13T22:54:53.724Z", "dateUpdated": "2026-04-15T20:03:28.442Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Crypt-SecretBuffer", "product": "Crypt::SecretBuffer", "programFiles": ["SecretBuffer.xs"], "programRoutines": [{"name": "Crypt::SecretBuffer::memcmp"}], "repo": "https://github.com/nrdvana/perl-Crypt-SecretBuffer", "vendor": "NERDVANA", "versions": [{"lessThan": "0.019", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks.\n\nFor example, if Crypt::SecretBuffer was used to store and compare plaintext passwords, then discrepencies in timing could be used to guess the secret password."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-13T22:54:53.724Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/NERDVANA/Crypt-SecretBuffer-0.019/source/Changes"}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.019 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/13/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-14T01:34:38.681Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T19:59:41.270630Z", "id": "CVE-2026-5086", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T20:03:28.442Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/13/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-14T01:34:38.681Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-5086", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T19:59:41.270630Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T20:00:10.997Z"}}], "cna": {"title": "Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/nrdvana/perl-Crypt-SecretBuffer", "vendor": "NERDVANA", "product": "Crypt::SecretBuffer", "versions": [{"status": "affected", "version": "0", "lessThan": "0.019", "versionType": "custom"}], "packageName": "Crypt-SecretBuffer", "programFiles": ["SecretBuffer.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Crypt::SecretBuffer::memcmp"}]}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.019 or later."}], "references": [{"url": "https://metacpan.org/release/NERDVANA/Crypt-SecretBuffer-0.019/source/Changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks.\n\nFor example, if Crypt::SecretBuffer was used to store and compare plaintext passwords, then discrepencies in timing could be used to guess the secret password."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-13T22:54:53.724Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5086", "state": "PUBLISHED", "dateUpdated": "2026-04-15T20:03:28.442Z", "dateReserved": "2026-03-28T19:22:27.564Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-04-13T22:54:53.724Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}