CVE-2026-6659 RSAVAGE CVE debrief

Who should care

Organizations using Perl-based authentication systems, system administrators managing legacy password storage, security teams assessing cryptographic implementations, and developers maintaining applications dependent on Crypt::PasswdMD5 for password hashing operations.

Technical summary

The Crypt::PasswdMD5 Perl module through version 1.42 uses Perl's built-in rand() function to generate salts for MD5-based password hashing. The rand() function is not cryptographically secure and produces predictable sequences, violating CWE-338 (Use of Cryptographically Weak PRNG). An attacker with knowledge of the random seed or through observation of generated salts can predict future salt values, enabling precomputation attacks and significantly reducing the effective security of password hashes. The vulnerability is classified as CVSS 3.1 HIGH severity (7.5) with network attack vector, low attack complexity, and no required privileges or user interaction. The confidentiality impact is rated HIGH while integrity and availability impacts are NONE.

Defensive priority

HIGH

Recommended defensive actions

• Upgrade to Crypt::PasswdMD5 version 1.43 or later which replaces the insecure rand() implementation
• Audit systems for password hashes generated with affected versions and consider re-hashing with secure salt generation
• Review applications using Crypt::PasswdMD5 for password storage and verify salt uniqueness cannot be predicted
• Monitor for unusual authentication patterns that may indicate precomputed hash attacks
• If immediate upgrade is not possible, implement application-layer salt generation using cryptographically secure random sources before passing to Crypt::PasswdMD5

Evidence notes

The vulnerability was disclosed via oss-security mailing list on 2026-05-08. NVD records indicate the issue was modified on 2026-05-26. The affected code resides in the salt generation routine of Crypt::PasswdMD5.pm at lines 35-47 in version 1.42. A fix was committed and released in version 1.43.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.