EUVD-2026-29956
GHSA-3p6c-7qjr-35x9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
4DescriptionCVE.org
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input.
The auto-detect form of argon2_verify passes encoded_len - 1 as the length argument to memchr without checking that encoded_len is non-zero. When the encoded string is empty, the size_t subtraction underflows to SIZE_MAX and memchr scans adjacent heap memory looking for a '$' separator byte.
A caller that invokes argon2_verify against a stored hash that may legitimately be empty (for example a placeholder row or a NULL column materialised as an empty string) reads out-of-bounds heap memory, which can crash the process or leak the position of an adjacent '$' byte into subsequent parsing.
AnalysisAI
Heap out-of-bounds read in Crypt::Argon2 for Perl (versions 0.017 through 0.030) exposes applications to process crash or heap memory leakage when argon2_verify is called with an empty encoded hash string. The defect is a size_t integer underflow: the auto-detect variant of argon2_verify subtracts 1 from encoded_len without a zero-check, wrapping to SIZE_MAX and causing memchr to scan up to SIZE_MAX bytes of adjacent heap memory. No public exploit has been identified and no CISA KEV listing exists; EPSS is 0.03% (9th percentile), consistent with the SSVC assessment of exploitation status 'none'.
Technical ContextAI
Crypt::Argon2 is a Perl XS (C extension) module wrapping the Argon2 password hashing algorithm, distributed via CPAN under author LEONT (CPE: cpe:2.3:a:leont:crypt::argon2:*:*:*:*:*:*:*:*). The flaw resides in Argon2.xs in the auto-detect form of argon2_verify, which must identify the Argon2 variant (2d, 2i, 2id) by scanning for a '$' separator byte. The root cause is CWE-126 (Buffer Over-Read): the expression encoded_len - 1 is computed as a size_t (unsigned) argument to memchr without first checking that encoded_len is non-zero. On 64-bit systems this underflow produces SIZE_MAX (2^64-1), causing memchr to scan nearly unbounded adjacent heap memory. The fix confirmed in the commit diff is a single conditional guard - encoded_len ? memchr(encoded_raw + 1, '$', encoded_len - 1) : NULL - followed by an explicit Perl exception if the separator is absent, preventing the out-of-bounds scan entirely.
RemediationAI
Upgrade Crypt::Argon2 to version 0.031 or later via CPAN using 'cpan install Crypt::Argon2' or 'cpanm Crypt::Argon2'. Version 0.031 is confirmed as the vendor-released patched release per the changelog at https://metacpan.org/release/LEONT/Crypt-Argon2-0.031/changes and the patch commit at https://github.com/Leont/crypt-argon2/commit/92eac03ce63d541e0ead7ea5a89b9b67ce0c0e64.patch. As a compensating control before patching, applications should add an explicit non-empty check on the encoded hash string before calling argon2_verify - for example, rejecting any stored hash that is undef, NULL, or zero-length at the application layer before it reaches the XS function. This can be enforced with a simple Perl length() or defined-and-length guard at no performance cost and eliminates the triggering condition entirely. Applications using ORMs or database abstractions that may silently coerce NULL columns to empty strings are particularly advised to audit this call path.
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password has
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could wea
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak a
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts
Private-key recovery in the Crypt::DSA Perl module (all versions before 1.22) stems from a biased random number generato
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl
Heap buffer overflow in Crypt::SysRandom::XS before version 0.010 allows denial of service through negative length param
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined
Secret-recovery via timing side channel in the Perl module Crypt::SecretBuffer before 0.019 lets remote attackers infer
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today