CVE-2026-12205 PUBLISHED

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery

Assigner: CPANSec
Reserved: 14.06.2026 Published: 15.06.2026 Updated: 15.06.2026

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery.

Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it.

The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical "r".

Keys used to sign more than once with an affected version should be considered compromised.

Product Status

Vendor TIMLEGGE
Product Crypt::DSA
Versions Default: unaffected
  • affected from 0 to 1.21 (excl.)

Solutions

Upgrade to version 1.21

Revoke any keys that may have been compromised.

Crypt::DSA was deprecated in version 1.20. You should migrate to another solution.

Credits

  • Richard Kettlewell finder

References

Problem Types

  • CWE-323 Reusing a Nonce, Key Pair in Encryption CWE