CVE-2026-9638
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jun 12, 2026
CISA due date
—
The record
Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | perl-Crypt-PBKDF2 | 0 | 0.261630-1.1 |
Related vulnerabilities
- CVE-2026-9641 Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number… Also affects perl-Crypt-PBKDF2
- CVE-2017-20240 Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. Also affects perl-Crypt-PBKDF2
- CVE-2026-74887 openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne… CWE-338
- CVE-2026-71851 crypto-js is a JavaScript library of crypto standards. CWE-338
- CVE-2026-16615 A flaw was found in librest. CWE-338
- CVE-2026-14495 The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via… CWE-338
- CVE-2026-7830 UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication… CWE-338
- CVE-2026-44040 UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to… CWE-338