Versions of Crypt::SecretBuffer prior to 0.019 allow measurable timing differences during secret comparisons. An attacker can exploit these non‑constant‑time operations to infer passwords or other sensitive data, compromising confidentiality. The weakness corresponds to the common software defect in which comparisons depend on data value, classified as CWE‑208.

The Vulnerable component is the NERDVANA Crypt::SecretBuffer Perl module. All releases older than version 0.019 contain the flaw and are susceptible while the module is used to store or compare secrets.

Based on the description, the likely attack vector involves an attacker triggering the module locally or observing its execution timing, requiring moderate skill and repeated trials to mount a successful timing attack. The vulnerability has a CVSS score of 7.5 and an EPSS score of <1%, indicating high severity but a very low likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The overall risk is significant for applications relying on this module for password handling.