CVE-2026-74846: Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier

As cited

Copy frozen at 2026-11-03 21:13 UTC (site build).

vulnerabilities

CVE-2026-74846: Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier

CVE-2026-74846 affects Catalyst::Plugin::Authentication for Perl versions before 0.10029, which use insecure equality comparisons (eq) in the legacy password verifier. This design allows timing attacks where an attacker can infer password characters by measuring how long password verification takes.

Why it matters: Perl developers and maintainers using Catalyst::Plugin::Authentication in production should upgrade to version 0.10029 or later to eliminate the timing side-channel that exposes stored password information.

Source published

2026-11-03 19:45 UTC

First seen by Cybersecurity Tracker

2026-11-03 20:00 UTC