CVE-2026-14570: CWE-330 Use of Insufficiently Random Values in TIMLEGGE Crypt::DSA
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery. "Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer for prime search. The signing nonce and the private key are drawn from makerandom. Because the high bit is always set, the result is not uniform: its top bit is fixed, producing insecure values." An attacker who collects a modest number of signatures under an affected key, together with the public key, can recover the private key with a lattice attack. Keys used to sign with an affected version should be considered compromised and new keys should be generated.
AI Analysis
Technical Summary
Crypt::DSA versions before 1.22 suffer from insufficient randomness in the generation of DSA signing nonces and private keys. The function Crypt::DSA::Util::makerandom sets the high bit of every generated value to produce an exactly N-bit integer, resulting in a biased distribution where the top bit is always set. This predictable bias enables an attacker to perform a lattice attack to recover the private key after collecting a modest number of signatures and the corresponding public key. This vulnerability is classified as CWE-330 (Use of Insufficiently Random Values).
Potential Impact
An attacker who obtains multiple signatures generated by an affected version of Crypt::DSA along with the public key can recover the private key. This compromises the confidentiality of the private key, allowing the attacker to forge signatures or impersonate the key owner. The vulnerability does not affect integrity or availability directly but leads to a critical loss of key secrecy.
Mitigation Recommendations
No official patch or fix is currently confirmed. Users should consider all keys generated or used with Crypt::DSA versions prior to 1.22 as compromised and generate new keys using a fixed or updated version once available. Monitor the vendor advisory for updates regarding an official fix or patch. Until then, avoid using affected versions for signing operations.
CVE-2026-14570: CWE-330 Use of Insufficiently Random Values in TIMLEGGE Crypt::DSA
Description
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery. "Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer for prime search. The signing nonce and the private key are drawn from makerandom. Because the high bit is always set, the result is not uniform: its top bit is fixed, producing insecure values." An attacker who collects a modest number of signatures under an affected key, together with the public key, can recover the private key with a lattice attack. Keys used to sign with an affected version should be considered compromised and new keys should be generated.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Crypt::DSA versions before 1.22 suffer from insufficient randomness in the generation of DSA signing nonces and private keys. The function Crypt::DSA::Util::makerandom sets the high bit of every generated value to produce an exactly N-bit integer, resulting in a biased distribution where the top bit is always set. This predictable bias enables an attacker to perform a lattice attack to recover the private key after collecting a modest number of signatures and the corresponding public key. This vulnerability is classified as CWE-330 (Use of Insufficiently Random Values).
Potential Impact
An attacker who obtains multiple signatures generated by an affected version of Crypt::DSA along with the public key can recover the private key. This compromises the confidentiality of the private key, allowing the attacker to forge signatures or impersonate the key owner. The vulnerability does not affect integrity or availability directly but leads to a critical loss of key secrecy.
Mitigation Recommendations
No official patch or fix is currently confirmed. Users should consider all keys generated or used with Crypt::DSA versions prior to 1.22 as compromised and generate new keys using a fixed or updated version once available. Monitor the vendor advisory for updates regarding an official fix or patch. Until then, avoid using affected versions for signing operations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-07-03T10:37:19.787Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a49b8d527e9c79719b72a73
Added to database: 07/05/2026, 01:52:21 UTC
Last enriched: 07/12/2026, 08:57:54 UTC
Last updated: 08/18/2026, 17:02:15 UTC
Views: 222
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.