CVE-2026-6659 identifies a vulnerability in Crypt::PasswdMD5 (up to version 1.42) where the module uses Perl's built-in rand function to generate salts for password hashing. The rand function is predictable and not suitable for cryptographic purposes, leading to weak salt values. This weakness can reduce the effectiveness of password hashing by making it easier for attackers to predict or reproduce salts, thereby facilitating certain cryptographic attacks. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality only. There is no vendor advisory or patch information available at this time.

The use of a predictable pseudo-random number generator for salt generation compromises the confidentiality of hashed passwords by making salts easier to guess or reproduce. This weakens the cryptographic protection of stored passwords, potentially enabling attackers to perform more efficient precomputed or rainbow table attacks. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding Crypt::PasswdMD5 for cryptographic purposes or implement alternative, cryptographically secure random number generators for salt generation.