EUVD-2026-36470
GHSA-v9r4-9w2c-2xcp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise database or backup to extract hashes
-
DeliveryIdentify PBKDF2-HMAC-SHA1 hash format with 1,000 iterations
-
ExploitLoad hashes into GPU cracking tool
-
ExecutionBrute-force at high iteration-reduced rate
-
PersistRecover plaintext passwords
-
ImpactCredential reuse or direct account takeover
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires two prerequisites: first, the application must use Crypt::PBKDF2 without explicitly overriding the default algorithm (HMAC-SHA1) and default iteration count (1,000 iterations) - any application that explicitly sets a modern algorithm and high iteration count is not affected by this default-configuration weakness. Second, the attacker must separately obtain the stored password hashes, typically via a database breach, SQL injection, or backup compromise; the vulnerability itself does not provide a mechanism to extract hashes. Exploitation is bounded to versions prior to 0.261630. The CVSS PR:N reflects that no privileges on the target system are required for the cracking phase once hashes are in hand. There is no user interaction component - the weakness is entirely in the hashing configuration, not in any user-triggerable code path. |
| Impact | The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects partial confidentiality impact with no authentication required, which aligns with the offline cracking phase of exploitation - once hashes are obtained, no privileges on the target system are needed to crack them. However, the real-world risk is conditional: exploitation requires a prior, separate compromise of the credential store (e.g., database exfiltration via SQL injection or backup theft). No EPSS data was provided in the available intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. No POC is identified. The absence of EPSS data means probabilistic exploitation likelihood cannot be quantified from available signals. Risk is highest for applications that use Crypt::PBKDF2 with default settings for user authentication - especially if those systems have previously suffered any data exposure - and for deployments that have accumulated years of hashes under the weak defaults. The weakness is silent and retrospective: upgrading the library does not retroactively strengthen existing hashes, so even patched deployments remain exposed until a rehashing migration is completed. |
| Exploit ScenarioDerived | An attacker who exfiltrates a database from an application built on Crypt::PBKDF2 with default settings obtains HMAC-SHA1 hashes with only 1,000 iterations. Loading these hashes into hashcat with the PBKDF2-HMAC-SHA1 module, the attacker achieves cracking rates several billion candidates per second on a commodity GPU - compared to under a million per second at OWASP-recommended iteration counts - recovering plaintext passwords in minutes for common passwords and hours for moderate-complexity ones. The recovered credentials are then used for account takeover on the original application or for credential-stuffing attacks against third-party services where users reuse passwords. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 12, 2026
Crypt::PBKDF2 for Perl prior to version 0.261630 ships with critically weak password-hashing defaults - HMAC-SHA1 as the pseudorandom function and only 1,000 iterations - leaving derived keys and stored passwords highly vulnerable to offline brute-force attacks. Applications that do not explicitly override these defaults expose any compromised credential store to cracking at rates orders of magnitude faster than OWASP-recommended configurations (220,000-1,400,000 iterations depending on algorithm). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the structural nature of CWE-916 means all previously generated hashes using the weak defaults remain exploitable even after upgrading the library unless proactively rehashed.
RemediationAI
Upgrade Crypt::PBKDF2 to version 0.261630 or later using CPAN or cpanm; the vendor-confirmed fix is documented at https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changes. Upgrading alone is insufficient: any password hashes previously generated using the weak defaults (HMAC-SHA1, 1,000 iterations) remain vulnerable and must be rehashed. Implement a transparent rehashing migration - on next successful user login, verify the existing hash, then regenerate and store a new hash using an explicit modern configuration (HMAC-SHA256 with at least 600,000 iterations, or HMAC-SHA512 with at least 210,000 iterations, per the OWASP guidance at https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2). Note that changing algorithm or iteration count requires storing a version flag alongside each hash so the application knows which parameters to use during verification. As an immediate compensating control for systems that cannot upgrade right away, explicitly pass a strong algorithm and high iteration count on every Crypt::PBKDF2 call rather than relying on defaults - this prevents new weak hashes from being created but does not remediate existing ones.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PBKDF2 (Password-Based Key Derivation Function 2, RFC 8018) derives cryptographic keys from passwords by applying a pseudorandom function - typically HMAC paired with a hash - across thousands of iterations, with the iteration count serving as the primary defense against brute-force attacks. CWE-916 (Use of Password Hash With Insufficient Computational Effort) captures this class of weakness: too few iterations or use of a fast, legacy hash algorithm collapses the computational barrier that makes offline cracking impractical. The affected CPE cpe:2.3:a:arodland:crypt::pbkdf2:*:*:*:*:*:*:*:* covers all Crypt::PBKDF2 releases before 0.261630. In affected versions, the default PRF is HMAC-SHA1 - which OWASP explicitly restricts to legacy systems - and the default iteration count is 1,000, whereas OWASP's Password Storage Cheat Sheet (referenced in the CVE) specifies a minimum of 1,300,000 iterations for HMAC-SHA1 and 600,000 for HMAC-SHA256. The gap between the library's defaults and current guidance represents a roughly three-order-of-magnitude reduction in cracking resistance, enabling GPU-accelerated tools such as hashcat to test billions of candidates per second against affected hashes.
Know when Crypt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Offline hash cracking requires no target-system privileges or user interaction; C:L reflects partial credential exposure with no integrity or availability impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations.
The default algorithm is HMAC-SHA1, which should only be used for legacy systems.
These versions default to using 1000 iterations.
Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password has
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could wea
Crypt::Sodium::XS for Perl bundles a vulnerable version of libsodium (<= 1.0.20) that has a signature verification flaw.
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak a
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts
Private-key recovery in the Crypt::DSA Perl module (all versions before 1.22) stems from a biased random number generato
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl
Heap buffer overflow in Crypt::SysRandom::XS before version 0.010 allows denial of service through negative length param
Heap buffer overflow in Perl's Crypt::URandom module (versions 0.41-0.54) allows denial of service through integer wrapa
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB