CVE-2026-6659: Rsavage crypt::passwdmd5

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The built-in rand function is predictable, and unsuitable for cryptography.

Affected products

• Rsavage crypt::passwdmd5: up to and including 1.42

Published 2026-05-08. Last modified 2026-06-17.