CVE-2026-5086
Nerdvana Crypt\ \
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2026-5086 is a high-severity Observable Timing Discrepancy (CWE-208) vulnerability in Nerdvana Crypt\. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-5086 is a vulnerability in Crypt::SecretBuffer versions before 0.019 for Perl, making it susceptible to timing attacks (CWE-208). The issue arises when the module is used for operations like storing and comparing plaintext passwords, where differences in execution timing could leak information about the secret.
Remote attackers can exploit this vulnerability with network access, low attack complexity, no privileges, and no user interaction required, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Successful exploitation enables high-impact confidentiality breaches, such as guessing passwords through observed timing discrepancies during comparisons.
The patch in Crypt::SecretBuffer version 0.019 addresses the timing attack vulnerability, with details documented in the module's Changes file available at https://metacpan.org/release/NERDVANA/Crypt-SecretBuffer-0.019/source/Changes. Additional information on the issue and remediation appears in the oss-security mailing list post at http://www.openwall.com/lists/oss-security/2026/04/13/12.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22136
Vulnerability Data
Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks. For example, if Crypt::SecretBuffer was used to store and compare plaintext passwords, then discrepencies in timing could be used to guess the secret password.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote network-accessible timing attack on password comparison in Perl module enables exploitation of public-facing apps (T1190) to facilitate password guessing (T1110.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of the specific timing attack flaw in Crypt::SecretBuffer versions before 0.019 via patching to version 0.019.
Mandates cryptographic mechanisms that protect against unauthorized disclosure of secrets, addressing timing discrepancies that leak password information during comparisons.
Facilitates detection of the vulnerable Crypt::SecretBuffer library through regular vulnerability scanning, enabling timely remediation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require constant-time implementations that eliminate observable timing discrepancies.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Consistent reference clocks limit the attacker's ability to measure or manipulate timing differences that could reveal internal state or processing paths.