https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 19:21:52 +0000 https://db.gcve.eu/vuln/cve-2026-74846 <p><strong>Affected:</strong> Catalyst-Plugin-Authentication</p> <p>Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.</p> <p>CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.</p> <p>A remote attacker can use response-time differences to guess the stored password or hash.</p> <p><strong>Affected:</strong> Catalyst-Plugin-Authentication</p> <p>Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.</p> <p>CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.</p> <p>A remote attacker can use response-time differences to guess the stored password or hash.</p> https://db.gcve.eu/vuln/cve-2026-74846