https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 08:24:27 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-74846 <p>Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.</p> <p>CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.</p> <p>A remote attacker can use response-time differences to guess the stored password or hash.</p> <p>Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.</p> <p>CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.</p> <p>A remote attacker can use response-time differences to guess the stored password or hash.</p> https://db.gcve.eu/vuln/fkie_cve-2026-74846 https://db.gcve.eu/vuln/ghsa-p4f5-m8h6-x7p5 <p>Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.</p> <p>CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.</p> <p>A remote attacker can use response-time differences to guess the stored password or hash.</p> <p>Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.</p> <p>CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.</p> <p>A remote attacker can use response-time differences to guess the stored password or hash.</p> https://db.gcve.eu/vuln/ghsa-p4f5-m8h6-x7p5 https://db.gcve.eu/vuln/ubuntu-cve-2026-74846 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libcatalyst-plugin-authentication-perl, Ubuntu:18.04:LTS: libcatalyst-plugin-authentication-perl, Ubuntu:20.04:LTS: libcatalyst-plugin-authentication-perl, Ubuntu:22.04:LTS: libcatalyst-plugin-authentication-perl, Ubuntu:24.04:LTS: libcatalyst-plugin-authentication-perl, Ubuntu:26.10: libcatalyst-plugin-authentication-perl, Ubuntu:26.04:LTS: libcatalyst-plugin-authentication-perl</p> <p>Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match. A remote attacker can use response-time differences to guess the stored password or hash.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libcatalyst-plugin-authentication-perl, Ubuntu:18.04:LTS: libcatalyst-plugin-authentication-perl, Ubuntu:20.04:LTS: libcatalyst-plugin-authentication-perl, Ubuntu:22.04:LTS: libcatalyst-plugin-authentication-perl, Ubuntu:24.04:LTS: libcatalyst-plugin-authentication-perl, Ubuntu:26.10: libcatalyst-plugin-authentication-perl, Ubuntu:26.04:LTS: libcatalyst-plugin-authentication-perl</p> <p>Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match. A remote attacker can use response-time differences to guess the stored password or hash.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-74846