CVE-2026-12205: Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery

Synopsis

Nonce reuse in Crypt::DSA (Perl) before version 1.21 allows an attacker to recover the private signing key from any two signatures produced by the same Key object. The vulnerability is reachable over the network without authentication, as any service that signs data and returns or exposes signatures to remote clients leaks the material needed for key recovery. Successful exploitation gives the attacker the private DSA key, enabling them to forge arbitrary signatures on behalf of the compromised identity. A patched-image rebuild at version 1.21 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the signing service over the network to collect two or more signatures produced by the same Key object.

• AuthenticationNot required

  No credentials are needed; any unauthenticated client that can request signatures from the affected service obtains the necessary material.

• Victim interactionNot required

  No user action is required; the vulnerability is triggered purely by the service performing its normal signing operations.

• Attack complexityDetail

  Exploitation is reliable and condition-free once two signatures with the same nonce are collected, as the key recovery math is deterministic with no environmental dependencies.

Blast Radius

• Attacker recovers the full private DSA key from as few as two observed signatures, with no further access to the host required.
• With the recovered private key, the attacker forges valid signatures on arbitrary data, bypassing any integrity or authenticity guarantee that key was providing.
• All previously issued signatures from the compromised key can no longer be trusted, requiring revocation and re-issuance of dependent certificates or tokens.