The Crypt::SaltedHash Perl module up to version 0.09 uses Perl's built-in eq operator for comparing hashes, which introduces observable timing discrepancies. These discrepancies can be exploited in timing attacks to guess the underlying hash values, representing a CWE-208 (Observable Timing Discrepancy) vulnerability. No CVSS score or official remediation has been published, and no exploits are known in the wild.

An attacker with the ability to measure response times accurately could leverage timing differences in hash comparisons to infer sensitive hash values. This could weaken the security of authentication or data integrity mechanisms relying on Crypt::SaltedHash. However, no known exploits have been reported, and the practical impact depends on the attacker's access and measurement precision.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding the vulnerable versions or implementing constant-time comparison functions to mitigate timing attacks.