PT-2026-34646 · Starman+1 · Starman+1

Published 2026-04-23 · Updated 2026-06-10 · CVE-2026-41564

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CryptX versions prior to 0.088

Description CryptX for Perl fails to reseed the Crypt::PK Pseudo-Random Number Generator (PRNG) state after a fork operation. The modules Crypt::PK::RSA, Crypt::PK::DSA, Crypt::PK::DH, Crypt::PK::ECC, Crypt::PK::Ed25519, and Crypt::PK::X25519 seed a per-object PRNG state during construction and reuse it without detecting forks. Consequently, any Crypt::PK::* object created before fork() shares an identical PRNG state across all child processes. This can lead to identical outputs for randomized operations, including key generation. Specifically, two ECDSA or DSA signatures from different processes can allow the recovery of the signing private key through nonce-reuse key recovery. This issue impacts preforking services, such as the Starman web server, where objects loaded at startup are inherited by worker processes.

Recommendations Update to version 0.088 or later.

Exploit

Fix

Weakness Enumeration

CWE-338

CWE-335

Related Identifiers

CVE-2026-41564

OPENSUSE-SU-2026:10773-1

OPENSUSE-SU-2026:20936-1

Affected Products

Cryptx

Starman

References · 23

• 🔥 https://github.com/DCIT/perl-CryptX/security/advisories/GHSA-24c2-gp6c-24c6 · Exploit
• https://github.com/DCIT/perl-CryptX/commit/9a1dd3e0c27d68e32450be5538b864c2b115ee15.patch · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:20936-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41564 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10773-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41564 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41564 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41564 · Security Note
• https://ubuntu.com/security/CVE-2026-41564 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-41564 · Vendor Advisory
• https://security.alpinelinux.org/vuln/CVE-2026-41564 · Note
• https://suse.com/security/cve/CVE-2026-41565 · Note
• https://suse.com/security/cve/CVE-2026-41564 · Note
• https://bugzilla.suse.com/1266804 · Note