CVE-2026-41564

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41564
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-41564.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-41564
Aliases
  • GHSA-24c2-gp6c-24c6
Downstream
Published
2026-04-23T07:29:26.340Z
Modified
2026-05-01T04:32:48.907372Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking
Details

CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking.

The Crypt::PK::RSA, Crypt::PK::DSA, Crypt::PK::DH, Crypt::PK::ECC, Crypt::PK::Ed25519 and Crypt::PK::X25519 modules seed a per-object PRNG state in their constructors and reuse it without fork detection. A Crypt::PK::* object created before fork() shares byte-identical PRNG state with every child process, and any randomized operation they perform can produce identical output, including key generation. Two ECDSA or DSA signatures from different processes are enough to recover the signing private key through nonce-reuse key recovery.

This affects preforking services such as the Starman web server, where a Crypt::PK::* object loaded at startup is inherited by every worker process.

Database specific 
{
    "cwe_ids": [
        "CWE-335",
        "CWE-338"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41564.json",
    "cna_assigner": "CPANSec"
}
References

Affected packages

Git / github.com/dcit/perl-cryptx

Affected ranges

Type
GIT
Repo
https://github.com/dcit/perl-cryptx
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8c5b713a84fd1c6f752edd8c545073b1bdeb2eec
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.088"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.022
v0.023
v0.024
v0.025
v0.026
v0.029
v0.030
v0.031
v0.032
v0.033
v0.034
v0.035
v0.036
v0.037
v0.038
v0.039
v0.040
v0.041
v0.042
v0.043
v0.044
v0.045
v0.046
v0.047
v0.048
v0.049
v0.050
v0.051
v0.052
v0.053
v0.054
v0.055
v0.056
v0.057
v0.058
v0.059
v0.060
v0.061
v0.062
v0.063
v0.064
v0.065
v0.066
v0.067
v0.068
v0.069
v0.070
v0.071
v0.072
v0.073
v0.074
v0.075
v0.076
v0.077
v0.078
v0.079
v0.080
v0.082
v0.083
v0.084
v0.085
v0.086
v0.087

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-41564.json"