What is CVE-2026-75589?
CVE-2026-75589 is a vulnerability in Net::OAuth for Perl versions before 0.33 where HMAC-SHA1, HMAC-SHA256, and PLAINTEXT signature verifications use a non-constant-time comparison via the `eq` operator. This timing side-channel could allow attackers to forge valid signatures by measuring response times, and users should immediately upgrade to Net::OAuth version 0.33 to mitigate the issue.
Azərbaycanca: CVE-2026-75589 Perl-in Net::OAuth kitabxanasının 0.33-dən əvvəlki versiyalarında HMAC-SHA1, HMAC-SHA256 və PLAINTEXT imza yoxlamalarında qeyri-sabit zaman müqayisəsi (non-constant-time comparison) zəifliyidir. Bu, təcavüzkara eq operatorunun geri qayıtma vaxtını analiz edərək imza açarlarını sızdırmağa imkan verə bilər, ona görə də təcili olaraq Net::OAuth kitabxanasını 0.33 vərsiyasına yeniləmək tövsiyə olunur.
FAQ2
Which signature methods in Perl's Net::OAuth library are affected by CVE-2026-75589?
CVE-2026-75589 affects HMAC-SHA1, HMAC-SHA256, and PLAINTEXT signature verifications because they use a non-constant-time comparison via the `eq` operator.
What should be done to mitigate CVE-2026-75589?
To mitigate CVE-2026-75589, users should immediately upgrade Net::OAuth to version 0.33.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.