Crypt::PBKDF2 CVE-2026-9638

Exploitation requires that (1) the target application stores password hashes produced by Crypt::PBKDF2 before 0.261630 using the module's default/internal salt generation rather than caller-supplied salts, and (2) the attacker has already obtained those stored hashes through a separate compromise (database leak, backup theft, SQL injection). The weakness is in salt generation only, so applications that pass their own cryptographically secure salts into Crypt::PBKDF2 are not affected; conversely, the predictability of Perl's rand() depends on the seed and call sequence in the hosting process, so cross-process salt prediction may require additional knowledge of the application's rand() usage pattern.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5 High) reflects confidentiality impact only and appears overstated for this issue: predictable salts do not directly expose plaintext data over the network - they degrade the offline brute-force resistance of stored hashes that an attacker has already obtained through some other means. Realistically, this is a defense-in-depth weakness whose impact materializes only once a database of Crypt::PBKDF2 hashes is leaked. No public exploit identified at time of analysis and no EPSS or KEV signal is provided. The 'AV:N' rating is questionable since exploitation requires possession of the hash material rather than a network interaction with the library itself - security teams should treat this as a cryptographic hygiene fix rather than an emergency network-exposed RCE.

An attacker who obtains a dump of a password database hashed with a vulnerable Crypt::PBKDF2 version (for example via SQL injection or a backup leak) recovers or narrows the per-row salts by reconstructing the state of Perl's rand() PRNG from the sequence of stored salts. With predictable salts, the attacker can precompute PBKDF2 hashes for common passwords once and reuse the work across many accounts, or build a targeted rainbow table - dramatically reducing the cost of offline cracking compared to a properly random salt. No public exploit identified at time of analysis.