CVE-2026-9641
MEDIUMCrypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations
Title source: cnaDescription
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.
References (7)
Core 7
Core References
Technical Description technical-description
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2
Release Notes release-notes
https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changes
Scores
CVSS v3
5.3
EPSS
0.0019
EPSS Percentile
9.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-916
Status
published
Products (1)
ARODLAND/Crypt::PBKDF2
< 0.261630
Published
Jun 12, 2026
Tracked Since
Jun 12, 2026