The Crypt::Password Perl module up to version 0.28 uses the built-in eq operator in its check_password method, which introduces observable timing discrepancies. These discrepancies can be exploited in timing attacks to infer information about the underlying password hash, constituting a CWE-208 vulnerability. There is no vendor advisory or patch information available at this time.

An attacker with the ability to measure response times from the check_password method could leverage timing differences to gradually guess the password hash, potentially compromising password confidentiality. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider alternative password verification methods that use constant-time comparison functions to prevent timing attacks.