The flaw is in Crypt::Password’s check_password routine, where it uses Perl’s built‑in eq operator that leaks timing information. An attacker can exploit these timing discrepancies to incrementally deduce the correct hash bytes of a password. This leads to a timing‑leak weakness (CWE‑208) that compromises the confidentiality of stored password hashes during verification.

Affected is Dr. Steven’s Crypt::Password Perl module, versions up to and including 0.28. Any Perl application or system that imports this module for authentication—such as custom login scripts, web applications, or services that invoke check_password—is vulnerable.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of <1 % and the absence from CISA KEV suggest that exploitation is presently unlikely and would require significant effort or privileged access. The attack vector is likely remote if the authentication endpoint is exposed, but local exploitation is also possible by repeatedly invoking the vulnerable function to measure timing differences. Exploitation requires repeated calls to check_password and precise timing measurements, implying the need for network access to the authentication service or local execution privileges on the system.