Vulnerability · Published Aug 11, 2025 · Assigned by CPANSec
CVE-2025-40920Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces
High 8.6
In plain English
A high-severity security flaw in Catalyst::Authentication::Credential::HTTP from ETHER. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating UUIDs. * Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562. * The nonces should be generated from a strong cryptographic source, as per RFC 7616.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libcatalyst-authentication-credential-http-perl | no fix listed | DEBIAN-CVE-2025-40920 |
| Debian:13 | libcatalyst-authentication-credential-http-perl | no fix listed | DEBIAN-CVE-2025-40920 |
| Debian:14 | libcatalyst-authentication-credential-http-perl | 1.018-4 | DEBIAN-CVE-2025-40920 |
| Ubuntu:22.04:LTS | libcatalyst-authentication-credential-http-perl | no fix listed | UBUNTU-CVE-2025-40920 |
| Ubuntu:24.04:LTS | libcatalyst-authentication-credential-http-perl | no fix listed | UBUNTU-CVE-2025-40920 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ETHER | Catalyst::Authentication::Credential::HTTP | 0.06 – through 1.018 |
Weakness: CWE-340, CWE-338 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
References
- https://security.metacpan.org/patches/C/Catalyst-Authentication-Credential-HTTP/1.018/CVE-2025-40920-r1.patch patch
- https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/pull/1 issue-tracking
- https://metacpan.org/release/ETHER/Catalyst-Authentication-Credential-HTTP-1.018/source/lib/Catalyst/Authentication/Credential/HTTP.pm#L391
- https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations
- https://datatracker.ietf.org/doc/html/rfc7616#section-5.12
- https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18 patch
- http://www.openwall.com/lists/oss-security/2025/08/12/1