CVE-2026-5086

CVE-2026-5086 is a timing attack vulnerability affecting Crypt::SecretBuffer for Perl versions prior to 0.019. The flaw allows attackers to exploit variations in comparison timing when the library is used to store and validate sensitive data such as plaintext passwords, potentially enabling attackers to guess secrets through careful analysis of response times. The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction, indicating relatively low attack complexity. While the confidentiality impact is rated as high, there is no impact to integrity or availability. The FAUCET Risk Score of 48.0 out of 100 reflects moderate concern from a practical exploitation perspective. Currently, there is no evidence of active exploitation in the wild, and the vulnerability is not tracked on the CISA Known Exploited Vulnerabilities list. The extremely low EPSS score of 0.00015 suggests minimal real-world exploitation activity relative to the broader CVE landscape, and the vulnerability remains inactive on security community hot lists. Organizations should prioritize patching to version 0.019 or later, particularly if Crypt::SecretBuffer is used in security-critical applications involving password or credential comparison.