CVE-2026-8721

Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.95/view/Changes.md
http://www.openwall.com/lists/oss-security/2026/05/17/6

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Crypt::OpenSSL::PKCS12 hasta la 1.94 para Perl truncan contraseñas con NULLs incrustados. Los parámetros de contraseña en PKCS12.xs se declaran como char *, lo que se enruta a través del typemap predeterminado de Perl a SvPV_nolen. La longitud de Perl se descarta. El código C (o OpenSSL internamente) llama a strlen() en el búfer. Cualquier byte de contraseña en o después del primer NULL se descarta silenciosamente. Las contraseñas binarias / derivadas de KDF / derivadas de HMAC pierden entropía sin ninguna advertencia.

Information

Published : 2026-05-17 19:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-8721

Mitre link : CVE-2026-8721

CVE.ORG link : CVE-2026-8721

JSON object : View

Products Affected

No product.

CWE

CWE-170

Improper Null Termination

{"id": "CVE-2026-8721", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8721", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-18T12:56:25.907387Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/dsully/perl-crypt-openssl-pkcs12", "vendor": "JONASBN", "product": "Crypt::OpenSSL::PKCS12", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.94"}], "packageName": "Crypt-OpenSSL-PKCS12", "programFiles": ["PKCS12.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Crypt::OpenSSL::PKCS12::mac_ok"}, {"name": "Crypt::OpenSSL::PKCS12::changepass"}, {"name": "Crypt::OpenSSL::PKCS12::create"}, {"name": "Crypt::OpenSSL::PKCS12::create_as_string"}, {"name": "Crypt::OpenSSL::PKCS12::certificate"}, {"name": "Crypt::OpenSSL::PKCS12::ca_certificate"}, {"name": "Crypt::OpenSSL::PKCS12::private_key"}, {"name": "Crypt::OpenSSL::PKCS12::info_as_hash"}, {"name": "Crypt::OpenSSL::PKCS12::info"}]}]}], "published": "2026-05-17T19:16:25.310", "references": [{"url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.95/view/Changes.md", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/17/6", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-170"}]}], "descriptions": [{"lang": "en", "value": "Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs.\n\nPassword parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded.\n\nThe C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings."}, {"lang": "es", "value": "Las versiones de Crypt::OpenSSL::PKCS12 hasta la 1.94 para Perl truncan contrase\u00f1as con NULLs incrustados.\n\nLos par\u00e1metros de contrase\u00f1a en PKCS12.xs se declaran como char *, lo que se enruta a trav\u00e9s del typemap predeterminado de Perl a SvPV_nolen. La longitud de Perl se descarta.\n\nEl c\u00f3digo C (o OpenSSL internamente) llama a strlen() en el b\u00fafer. Cualquier byte de contrase\u00f1a en o despu\u00e9s del primer NULL se descarta silenciosamente. Las contrase\u00f1as binarias / derivadas de KDF / derivadas de HMAC pierden entrop\u00eda sin ninguna advertencia."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}