Re: CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL
CPAN removed Crypt::SelfCertificate 1.01–1.05 after CVE-2026-95831 identified a Python dropper.
CVE-2026-95831 covers Crypt::SelfCertificate versions 1.01 through 1.05 on CPAN, which contain malware that executes Python code retrieved from an obfuscated URL. Robert Rothenberg said every affected version has been removed, although copies may remain on independent mirrors, and that no reverse dependencies are known. Version 1.00 did not include the dropper but did not work properly and may have served as staging for an upgrade. CPANSec is still investigating.
- CVE-2026-95831 covers versions 1.01 through 1.05
- Malware executes Python fetched from an obfuscated URL
- Affected releases were removed; mirrors may still have copies
- No reverse dependencies are currently known
- CVEs
- CVE-2026-95831
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1059.006 PythonT1027 Obfuscated Files or InformationT1105 Ingress Tool Transfer
- Products
- Crypt::SelfCertificate
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-95831 | Embedded Malware in Perl CPAN Module Crypt::SelfCertificate 1.01–1.05 | 7.8 | — |
From the original article
Posted by Robert Rothenberg on Sep 23 We are not aware of reverse dependencies. Yes, all versions have been removed, however they may exist on independent mirrors. 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.