Crypt::SaltedHash versions through 0.09 depend on Perl’s built‑in eq comparison, which leaks timing information. An attacker who can trigger these comparisons can measure elapsed time to guess the underlying hash value, potentially compromising stored credentials and leading to credential theft or account takeover.

The vulnerability affects the Crypt::SaltedHash module for Perl (vendor RRWO) in all releases up to and including 0.09. Version 0.10 or later includes the fix. The product is commonly used to store salted passwords in Perl applications.

The CVSS score is 7.5 and the EPSS score is <1%, and the vulnerability is not listed in CISA’s KEV catalog. Therefore, the quantified risk is medium‑high severity with a low probability of exploitation. The attack vector is inferred to be possible when an application exposes the equality comparison—either via a public endpoint or internal logic—allowing an attacker to observe timing differences. Because any timing leak can be exploited repeatedly, the potential impact remains significant but the low EPSS score indicates a relatively low likelihood of exploitation under current public exposure assumptions.