Net::OAuth-0.33 Vulnerability Fixes: CVE-2025-22376/887/888

Vulnerability Overview In version Net-OAuth-0.33, several security vulnerabilities exist, primarily involving the improper use of encryption algorithms and signature methods. These vulnerabilities could allow attackers to perform attacks such as memory exhaustion and signature forgery. Impact Scope CVE-2026-72888: Net::OAuth::Client no longer allows silent downgrade from OAuth 1.0a to 1.0 when the remote provider drops the . This behavior can be re-enabled by setting the option. CVE-2026-72887: RSA-SHA1 now uses PKCS#1 v1.5 padding and SHA-1 hashing, rather than relying on the defaults of Crypt::OpenSSL::RSA, which have drifted (SHA-256 in 0.29.01, RSA-PSS in 0.35). For version 0.35 and later, this change will result in incompatibility where servers previously accepting signatures may reject them. Reported as Debian #1142954. CVE-2025-22376: Net::OAuth::Client now employs a better random number generation method for generating nonces. Remediation CVE-2026-72888: Validation algorithms are now restricted to those specified in the allowed . This is a breaking change. CVE-2026-72887: RSA-SHA1 now uses PKCS#1 v1.5 padding and SHA-1 hashing, instead of relying on the defaults of Crypt::OpenSSL::RSA. CVE-2025-22376: Net::OAuth::Client now uses an improved random number generation method for generating nonces. POC Code or Exploit Code No specific POC code or exploit code was provided. Summary Version Net-OAuth-0.33 contains several security vulnerabilities, mainly related to the improper use of encryption algorithms and signature methods. The remediation involves restricting validation algorithms, updating RSA-SHA1 padding and hashing methods, and employing better random number generation techniques. Users are advised to update to the latest version as soon as possible to address these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Net::OAuth-0.33 Vulnerability Fixes: CVE-2025-22376/887/888