CVE-2025-40920: Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. Data::UUID does not use a strong cryptographic source for generating UUIDs. Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562. The nonces should be generated from a strong cryptographic source, as per RFC 7616.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40920?
CVE-2025-40920 is a security vulnerability that arises from the use of weak cryptographic sources in earlier versions of Catalyst::Authentication::Credential::HTTP.
How do I fix CVE-2025-40920?
To fix CVE-2025-40920, update Catalyst::Authentication::Credential::HTTP to version 1.019 or later.
What is affected in CVE-2025-40920?
CVE-2025-40920 affects versions of Catalyst::Authentication::Credential::HTTP up to and including 1.018.
What is the risk of leaving CVE-2025-40920 unaddressed?
Leaving CVE-2025-40920 unaddressed increases the risk of UUID collisions and potential authentication vulnerabilities due to weak nonce generation.
Who is impacted by CVE-2025-40920?
Developers and organizations using vulnerable versions of Catalyst::Authentication::Credential::HTTP in their Perl applications are impacted by CVE-2025-40920.