Re: CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL
CVE-2026-95831: malicious Crypt::SelfCertificate 1.01–1.05 runs Python from an obfuscated URL.
OSS-Security discussion of CVE-2026-95831 says Crypt::SelfCertificate versions 1.01 through 1.05 on CPAN contain malware. The malicious releases execute Python code retrieved from an obfuscated URL. MetaCPAN requirement and changelog pages were not loading, which a poster attributed to the distribution being yanked. The follow-up asked whether the module ever had a legitimate release.
- CVE-2026-95831 covers Crypt::SelfCertificate versions 1.01 through 1.05.
- Those releases execute Python code fetched from an obfuscated URL.
- MetaCPAN pages were unavailable after the distribution was yanked.
- A reply asked whether any legitimate release ever existed.
- CVEs
- CVE-2026-95831
- Products
- Crypt::SelfCertificatePerl
- Organizations
- MetaCPAN
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-95831 | Embedded Malware in Perl CPAN Module Crypt::SelfCertificate 1.01–1.05 | 7.8 | — |
From the original article
Posted by Sam James on Sep 22 Robert Rothenberg writes: https://metacpan. org/dist/Crypt-SelfCertificate/requires https://metacpan. org/dist/Crypt-SelfCertificate/changes page doesn't work for me, presumably because it's all been yanked.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.