CVE-2026-9641

Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2
https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changes
http://www.openwall.com/lists/oss-security/2026/06/12/5
http://www.openwall.com/lists/oss-security/2026/06/13/1
http://www.openwall.com/lists/oss-security/2026/06/14/1
http://www.openwall.com/lists/oss-security/2026/06/14/2
http://www.openwall.com/lists/oss-security/2026/06/14/3

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Crypt::PBKDF2 anteriores a la 0.261630 para Perl tienen un algoritmo predeterminado débil y un número de iteraciones. El algoritmo predeterminado es HMAC-SHA1, el cual solo debería usarse para sistemas heredados. Estas versiones utilizan por defecto 1000 iteraciones. Dependiendo del algoritmo elegido, deberían utilizarse de 220.000 a 1.400.000 iteraciones.

Information

Published : 2026-06-12 16:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-9641

Mitre link : CVE-2026-9641

CVE.ORG link : CVE-2026-9641

JSON object : View

Products Affected

No product.

CWE

CWE-916

Use of Password Hash With Insufficient Computational Effort

{"id": "CVE-2026-9641", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9641", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T17:46:14.634769Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/arodland/Crypt-PBKDF2", "vendor": "ARODLAND", "product": "Crypt::PBKDF2", "versions": [{"status": "affected", "version": "0", "lessThan": "0.261630", "versionType": "custom"}], "packageName": "Crypt-PBKDF2", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}]}], "published": "2026-06-12T16:16:35.047", "references": [{"url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/12/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/13/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/14/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/14/2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/14/3", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-916"}]}], "descriptions": [{"lang": "en", "value": "Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations.\n\nThe default algorithm is HMAC-SHA1, which should only be used for legacy systems.\n\nThese versions default to using 1000 iterations.\n\nDepending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used."}, {"lang": "es", "value": "Las versiones de Crypt::PBKDF2 anteriores a la 0.261630 para Perl tienen un algoritmo predeterminado d\u00e9bil y un n\u00famero de iteraciones.\n\nEl algoritmo predeterminado es HMAC-SHA1, el cual solo deber\u00eda usarse para sistemas heredados.\n\nEstas versiones utilizan por defecto 1000 iteraciones.\n\nDependiendo del algoritmo elegido, deber\u00edan utilizarse de 220.000 a 1.400.000 iteraciones."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}