CVE-2026-47372

Description

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Overview

State: PUBLISHED
Assigner (CNA): CPANSec
CVSS severity: critical
CVSS score: 9.1 / 10
CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Effective score: 9.1 / 10 CRITICAL source: CNA overview
CWE(s): CWE-338
Reserved: 2026-05-19
Published: 2026-05-20 22:08 UTC
Last updated: 2026-05-21 00:37 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/47xxx/CVE-2026-47372.json
Linked Threat: CVE-2026-47372 — CVE-2026-47372

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-20 22:16:37 UTC
NVD last modified: 2026-05-21 16:04:53 UTC
NVD CVSS v3.1: 9.1 / 10 CRITICAL source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability subscore: 3.9 / 10
Impact subscore: 5.2 / 10
EPSS score: 0.0001 (probability of exploitation in next 30 days)
EPSS percentile: 1.31% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-31198
Assigner: CPANSec
Published: May 20, 2026, 10:08:12 PM
Updated: May 21, 2026, 2:12:28 PM
EUVD base score (CVSS 3.1): 9.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EUVD-reported EPSS: 0.0100
Vendors: RRWO
Products: Crypt::SaltedHash (0 ≤0.09)
Aliases: GHSA-h295-pfx3-r298

ENISA description: Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

EUVD references (2)

Affected products (1)

Vendor	Product	Versions	Platforms
RRWO	Crypt::SaltedHash	`0` (affected)	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

Web references (6)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

http://www.openwall.com/lists/oss-security/2026/05/20/22 tenable:www.openwall.com
https://github.com/robrwo/perl-Crypt-SaltedHash/commit/9b68437d2cd420b819b3a795474c3870338d38d5.patch tenable:github.com
https://metacpan.org/release/RRWO/Crypt-SaltedHash-0.10/changes tenable:metacpan.org
https://nvd.nist.gov/vuln/detail/CVE-2026-47372 tenable:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2026-47372 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

http://www.openwall.com/lists/oss-security/2026/05/20/22 af854a3a-2127-422b-91ae-364da2661108
https://github.com/robrwo/perl-Crypt-SaltedHash/commit/9b68437d2cd420b819b3a795474c3870338d38d5.patch 9b29abf9-4ab0-4765-b253-1875cd9b441e
https://metacpan.org/release/RRWO/Crypt-SaltedHash-0.10/changes 9b29abf9-4ab0-4765-b253-1875cd9b441e

Remediations (15)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft issues emergency update for macOS and Linux ASP.NET ...

web:arstechnica.com

Microsoft released an emergency patch for its ASP.NET Core to fix a high-severity vulnerability that allows unauthenticated attackers to gain SYSTEM privileges on devices that use the Web ...

2026-05-23 22:17 UTC
MicrosoftAspNetCoreDataProtection, Elevation of Privilege, CVE-2026 ...

web:dailycve.com

MicrosoftAspNetCoreDataProtection, Elevation of Privilege, CVE - 2026 -40372 (Critical) - "DailyCVE.com - The advanced vulnerability database with modern

2026-05-23 22:17 UTC
Microsoft Security Advisory CVE-2026-40372 - GitHub

web:github.com

Microsoft Security Advisory CVE - 2026 -40372 - ASP.NET Core Elevation of Privilege

2026-05-23 22:17 UTC
CVE-2026-47372 | Security Details | Sonatype Guide

web:guide.sonatype.com

Technical security analysis for CVE-2026-47372 . CVSS 9.1 severity. View CVSS vectors, CWE classifications, and exploit maturity ratings.

2026-05-23 22:17 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-05-23 22:17 UTC
Nvd - Cve-2026-40372

web:nvd.nist.gov

An official website of the United States government Here's how you know

2026-05-23 22:17 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-23 22:17 UTC
Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege ...

web:thehackernews.com

Microsoft has released out-of-band updates to address a security vulnerability in ASP.NET Core that could allow an attacker to escalate privileges. The vulnerability, tracked as CVE - 2026 -40372, carries a CVSS score of 9.1 out of 10.0. It's rated Important in severity. An anonymous researcher has been credited with discovering and reporting the flaw. "Improper verification of cryptographic ...

2026-05-23 22:17 UTC
Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days

web:www.bleepingcomputer.com

Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.

2026-05-23 22:17 UTC
Microsoft releases emergency patches for critical ASP.NET flaw

web:www.bleepingcomputer.com

Microsoft has released out-of-band (OOB) security updates to patch a critical ASP.NET Core privilege escalation vulnerability.

2026-05-23 22:17 UTC
CVE-2026-40372 - Vulnerability Details - OpenCVE

web:app.opencve.io

Remediation No vendor fix or workaround currently provided. OpenCVE Recommended Actions Apply the Microsoft security update that corrects the signature verification logic in ASP.NET Core. Audit all custom authentication components to ensure they use the updated cryptographic APIs and do not accept externally supplied data for signature validation.

2026-05-26 03:00 UTC
CVE-2026-40372 ASP.NET Core Flaw Emergency Patch

web:purple-ops.io

The regular issuance of out-of-band updates, as seen with CVE - 2026 -40372 and previous critical issues like the Microsoft zero-day patch fix , indicates the dynamic nature of threats, and organizations must remain vigilant. Mitigation and Remediation for CVE - 2026 -40372

2026-05-26 03:00 UTC
Emergency .NET Update: Critical Data Protection Flaw Allows ...

web:securityonline.info

Microsoft has issued an urgent out-of-band (OOB) security update for .NET 10 to address a critical vulnerability that could allow attackers to bypass authentication and escalate privileges. The update, version 10.0.7, arrives just after the standard April Patch Tuesday release following reports of severe cryptographic failures. The flaw, tracked as CVE - 2026 -40372, carries a CVSS score of 9.1 ...

2026-05-26 03:00 UTC
Microsoft Technical Security Notifications

web:www.microsoft.com

Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.

2026-05-26 03:00 UTC
ASP.NET Core Privilege Escalation Vulnerability (CVE-2026-40372)

web:www.sentrium.co.uk

Mitigation and remediation Microsoft has released .NET 10.0.7 as an out of band security update to address CVE - 2026 -40372. Organisations should update the Microsoft.AspNetCore.DataProtection package to version 10.0.7 or later, rebuild affected applications, and redeploy them to production environments.

2026-05-26 03:00 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-47372.json.

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-21T00:37:36.726Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/20/22"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Crypt-SaltedHash",
          "product": "Crypt::SaltedHash",
          "programFiles": [
            "lib/Crypt/SaltedHash.pm"
          ],
          "programRoutines": [
            {
              "name": "Crypt::SaltedHash::__generate_hex_salt"
            }
          ],
          "repo": "https://github.com/robrwo/perl-Crypt-SaltedHash",
          "vendor": "RRWO",
          "versions": [
            {
              "lessThanOrEqual": "0.09",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.\n\nThese versions use the built-in rand function, which is predictable and unsuitable for cryptography."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-338",
              "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-20T22:08:12.703Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/RRWO/Crypt-SaltedHash-0.10/changes"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/robrwo/perl-Crypt-SaltedHash/commit/9b68437d2cd420b819b3a795474c3870338d38d5.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to version 0.10 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-47372",
    "datePublished": "2026-05-20T22:08:12.703Z",
    "dateReserved": "2026-05-19T16:17:52.855Z",
    "dateUpdated": "2026-05-21T00:37:36.726Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}