EUVD-2026-36456
GHSA-3rw7-pf56-37cv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitation requires prior possession of leaked hashes and PRNG-state reconstruction (AV:L, AC:H); only partial credential recovery affects confidentiality (C:L), with no integrity or availability impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts.
These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
AnalysisAI
Predictable salt generation in the Perl Crypt::PBKDF2 module before version 0.261630 weakens the cryptographic strength of derived password hashes. The module uses Perl's built-in rand() function - a non-cryptographic PRNG - to generate salt values, making salts guessable and enabling precomputation attacks against stored password hashes. No public exploit identified at time of analysis, but a vendor patch is available and the issue was responsibly disclosed by CPANSec.
Technical ContextAI
Crypt::PBKDF2 is a Perl implementation of the PBKDF2 (Password-Based Key Derivation Function 2) key-stretching algorithm widely used to hash passwords for storage. PBKDF2's security depends critically on a unique, unpredictable per-password salt that prevents attackers from precomputing rainbow tables or reusing offline work across multiple targets. CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator) is the root cause: the affected code path (visible in lib/Crypt/PBKDF2.pm lines 86-93 on metacpan) calls Perl's built-in rand(), which is a linear congruential generator seeded from limited entropy and is not suitable for cryptographic use. The CPE cpe:2.3:a:arodland:crypt::pbkdf2 confirms the affected package is the ARODLAND-maintained distribution on CPAN.
RemediationAI
Vendor-released patch: 0.261630 - upgrade the Crypt::PBKDF2 CPAN distribution to version 0.261630 or later (see https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changes and the oss-security advisory at https://seclists.org/oss-sec/2026/q2/899). Because previously generated password hashes were salted with predictable values, simply upgrading does not retroactively strengthen existing stored credentials; operators should plan to force password rotation or rehash on next successful login so that new salts come from the patched CSPRNG path. As a temporary workaround for code you control, pass an explicit salt generated from Crypt::URandom or Crypt::PRNG (Bytes::Random::Secure) into the PBKDF2 generate() call instead of relying on the module's internal salt generator - the trade-off is that every caller must be audited and updated, which is more invasive than a single package upgrade.
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password has
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could wea
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak a
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts
Private-key recovery in the Crypt::DSA Perl module (all versions before 1.22) stems from a biased random number generato
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl
Heap buffer overflow in Crypt::SysRandom::XS before version 0.010 allows denial of service through negative length param
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined
Secret-recovery via timing side channel in the Perl module Crypt::SecretBuffer before 0.019 lets remote attackers infer
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today