CVE-2026-9641 Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations
MediumCVSS 5.3
EPSS 0.23%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations.
The default algorithm is HMAC-SHA1, which should only be used for legacy systems.
These versions default to using 1000 iterations.
Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ARODLAND Crypt::PBKDF2 | < 0.261630 | 0.261630 |
| ubuntu/libcrypt-pbkdf2-perl(Ubuntu:22.04) | All versions | No fix listed |
| debian/libcrypt-pbkdf2-perl(Debian:12) | < 0.261630-1~deb13u1~deb12u1 | 0.261630-1~deb13u1~deb12u1 |
| debian/libcrypt-pbkdf2-perl(Debian:12) | = 0.161520-2 | No fix listed |
| debian/libcrypt-pbkdf2-perl(Debian:13) | < 0.261630-1~deb13u1 | 0.261630-1~deb13u1 |
| debian/libcrypt-pbkdf2-perl(Debian:13) | = 0.161520-2 | No fix listed |
| debian/libcrypt-pbkdf2-perl(Debian:13) | = 0.261630-1~deb13u1~deb12u1 | No fix listed |
| debian/libcrypt-pbkdf2-perl(Debian:14) | < 0.261630-1 | 0.261630-1 |
| debian/libcrypt-pbkdf2-perl(Debian:14) | = 0.161520-2 | No fix listed |
| debian/libcrypt-pbkdf2-perl(Debian:14) | = 0.261630-1~deb13u1 | No fix listed |
| debian/libcrypt-pbkdf2-perl(Debian:14) | = 0.261630-1~deb13u1~deb12u1 | No fix listed |
| ubuntu/libcrypt-pbkdf2-perl(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libcrypt-pbkdf2-perl(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libcrypt-pbkdf2-perl(Ubuntu:26.10) | All versions | No fix listed |
References
- cheatsheetseries.owasp.org technical-description
- metacpan.org release-notes
- www.openwall.com
- www.openwall.com
- www.openwall.com
- www.openwall.com
- www.openwall.com
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2026-9641 vendor-advisory
- bugs.debian.org issue-tracking