CVE-2025-40920CWE-338CWE-340

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces

High · published August 11, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.

* Data::UUID does not use a strong cryptographic source for generating UUIDs.

* Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.

* The nonces should be generated from a strong cryptographic source, as per RFC 7616.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00444 · 37.6th percentile
Weaknesses
CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG); CWE-340 · Generation of Predictable Numbers or Identifiers
Published
2025-08-11T20:19Z
EPSS history
Timeline
  • 11 AUG 20:19Z
    Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces
    cvelistv5