CVE-2026-9641
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations
- Published
- Updated
- Reserved
- Assigned by
- CPANSec
Description
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVDNVD · Deferred | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.23% · top 87% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
Affected products
- affected < 0.261630
What to do
Solution: Upgrade to version 0.261630 or later.
Workaround: Change the default algorithm to something stronger, such as "HMACSHA2", and the output_len accordingly (32 for SHA256). The number of iterations should also be increased (600,000 for SHA256, for example).
References (7)
- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2 (opens in a new tab)technical-description
- https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changes (opens in a new tab)release-notes
- http://www.openwall.com/lists/oss-security/2026/06/12/5 (opens in a new tab)
- http://www.openwall.com/lists/oss-security/2026/06/13/1 (opens in a new tab)
- http://www.openwall.com/lists/oss-security/2026/06/14/1 (opens in a new tab)
- http://www.openwall.com/lists/oss-security/2026/06/14/2 (opens in a new tab)
- http://www.openwall.com/lists/oss-security/2026/06/14/3 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-9641)Record last updated .