CVE-2026-9638highCWE-338

CVE-2026-9638: falha de alta gravidade em ARODLAND Crypt::PBKDF2

Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts

Publicada em

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.5%
probabilidade de exploração
0.5%top 60% das CVEs
exploração observada
nãonenhuma fonte reporta
Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
ARODLAND · Crypt::PBKDF2
CVEs relacionadas — ARODLAND Crypt::PBKDF2

No mesmo produto, das mais perigosas para as menos.

CVE-2017-20240MEDIUMCrypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacksEPSS 0.3%CVE-2026-9641MEDIUMCrypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterationsEPSS 0.3%
Referências
https://metacpan.org/dist/Crypt-PBKDF2/source/lib/Crypt/PBKDF2.pm#L86-93https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changeshttp://www.openwall.com/lists/oss-security/2026/06/12/4