The vulnerability CVE-2026-47372 affects Crypt::SaltedHash versions up to 0.09, where the module uses Perl's built-in rand function to generate salts. Since rand is predictable and not designed for cryptographic use, the salts generated are insecure. This falls under CWE-338, indicating the use of a cryptographically weak pseudo-random number generator. No patch or official remediation has been documented yet, and no known exploits are reported in the wild.

The use of a predictable pseudo-random number generator for salt generation reduces the effectiveness of salting in password hashing or similar cryptographic operations. This can make it easier for attackers to perform precomputed hash attacks or reduce the entropy of the salt, weakening overall security. However, no direct exploit or active attacks have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using affected versions of Crypt::SaltedHash or implement their own cryptographically secure salt generation using a suitable cryptographic random number generator.