CVE-2026-12205
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical "r". Keys used to sign more than once with an affected version should be considered compromised.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS probability
- 0.29%
- CWE
- CWE-323
- Published
- 2026-06-15
- Last modified
- 2026-06-16
Affected products
- TIMLEGGE Crypt::DSA
Weakness type
Related vulnerabilities
- CVE-2026-81341 — wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records
- CVE-2026-81020 — wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
- CVE-2026-81019 — wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
- CVE-2026-50577 — ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter
- CVE-2026-17578 — Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement
- CVE-2026-21383 — Reusing a Nonce, Key Pair in Encryption in HLOS
- CVE-2026-59099 — Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure
- CVE-2026-13602 — Session takeover vulnerability