Vulnerability · Published Aug 19, 2026 · Assigned by CPANSec
CVE-2026-75589Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify
High 7.5
In plain English
A high-severity security flaw in Net-OAuth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two strings differ. The time taken to reject a signature varies with the length of the matching prefix. RSA-SHA1 is not affected, as it verifies through the RSA key object rather than by comparing strings. A client that can submit messages and time the replies may recover a valid signature one byte at a time rather than searching the whole signature space. Under PLAINTEXT the value compared against is the signature key itself, so the search recovers consumer_secret and token_secret.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libnet-oauth-perl | no fix listed | DEBIAN-CVE-2026-75589 |
| Debian:13 | libnet-oauth-perl | no fix listed | DEBIAN-CVE-2026-75589 |
| Debian:14 | libnet-oauth-perl | 0.33-1 | DEBIAN-CVE-2026-75589 |
| Ubuntu:22.04:LTS | libnet-oauth-perl | no fix listed | UBUNTU-CVE-2026-75589 |
| Ubuntu:24.04:LTS | libnet-oauth-perl | no fix listed | UBUNTU-CVE-2026-75589 |
| Ubuntu:26.04:LTS | libnet-oauth-perl | no fix listed | UBUNTU-CVE-2026-75589 |
| Ubuntu:26.10 | libnet-oauth-perl | no fix listed | UBUNTU-CVE-2026-75589 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Net-OAuth | 0 – before 0.33 |
Weakness: CWE-208 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-g8xr-69p3-gw56 vendor-advisory
- https://github.com/vurtdev/Net-OAuth/commit/a1a16b58add85668ef4fcda642a486ceed098eba.patch patch
- https://metacpan.org/release/RRWO/Net-OAuth-0.33/changes release-notes
- http://www.openwall.com/lists/oss-security/2026/08/19/3