EUVD-2026-36470
GHSA-v9r4-9w2c-2xcp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Offline hash cracking requires no target-system privileges or user interaction; C:L reflects partial credential exposure with no integrity or availability impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations.
The default algorithm is HMAC-SHA1, which should only be used for legacy systems.
These versions default to using 1000 iterations.
Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.
AnalysisAI
Crypt::PBKDF2 for Perl prior to version 0.261630 ships with critically weak password-hashing defaults - HMAC-SHA1 as the pseudorandom function and only 1,000 iterations - leaving derived keys and stored passwords highly vulnerable to offline brute-force attacks. Applications that do not explicitly override these defaults expose any compromised credential store to cracking at rates orders of magnitude faster than OWASP-recommended configurations (220,000-1,400,000 iterations depending on algorithm). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the structural nature of CWE-916 means all previously generated hashes using the weak defaults remain exploitable even after upgrading the library unless proactively rehashed.
Technical ContextAI
PBKDF2 (Password-Based Key Derivation Function 2, RFC 8018) derives cryptographic keys from passwords by applying a pseudorandom function - typically HMAC paired with a hash - across thousands of iterations, with the iteration count serving as the primary defense against brute-force attacks. CWE-916 (Use of Password Hash With Insufficient Computational Effort) captures this class of weakness: too few iterations or use of a fast, legacy hash algorithm collapses the computational barrier that makes offline cracking impractical. The affected CPE cpe:2.3:a:arodland:crypt::pbkdf2:*:*:*:*:*:*:*:* covers all Crypt::PBKDF2 releases before 0.261630. In affected versions, the default PRF is HMAC-SHA1 - which OWASP explicitly restricts to legacy systems - and the default iteration count is 1,000, whereas OWASP's Password Storage Cheat Sheet (referenced in the CVE) specifies a minimum of 1,300,000 iterations for HMAC-SHA1 and 600,000 for HMAC-SHA256. The gap between the library's defaults and current guidance represents a roughly three-order-of-magnitude reduction in cracking resistance, enabling GPU-accelerated tools such as hashcat to test billions of candidates per second against affected hashes.
RemediationAI
Upgrade Crypt::PBKDF2 to version 0.261630 or later using CPAN or cpanm; the vendor-confirmed fix is documented at https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changes. Upgrading alone is insufficient: any password hashes previously generated using the weak defaults (HMAC-SHA1, 1,000 iterations) remain vulnerable and must be rehashed. Implement a transparent rehashing migration - on next successful user login, verify the existing hash, then regenerate and store a new hash using an explicit modern configuration (HMAC-SHA256 with at least 600,000 iterations, or HMAC-SHA512 with at least 210,000 iterations, per the OWASP guidance at https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2). Note that changing algorithm or iteration count requires storing a version flag alongside each hash so the application knows which parameters to use during verification. As an immediate compensating control for systems that cannot upgrade right away, explicitly pass a strong algorithm and high iteration count on every Crypt::PBKDF2 call rather than relying on defaults - this prevents new weak hashes from being created but does not remediate existing ones.
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password has
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could wea
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak a
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts
Private-key recovery in the Crypt::DSA Perl module (all versions before 1.22) stems from a biased random number generato
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl
Heap buffer overflow in Crypt::SysRandom::XS before version 0.010 allows denial of service through negative length param
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined
Secret-recovery via timing side channel in the Perl module Crypt::SecretBuffer before 0.019 lets remote attackers infer
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today