CVE-2026-9641
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Jun 12, 2026
CISA due date
—
The record
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | perl-Crypt-PBKDF2 | 0 | 0.261630-1.1 |
Related vulnerabilities
- CVE-2026-9638 Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts. Also affects perl-Crypt-PBKDF2
- CVE-2017-20240 Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. Also affects perl-Crypt-PBKDF2
- CVE-2026-112026 A security vulnerability has been detected in light0011 cms… CWE-916
- CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. CWE-916
- CVE-2026-81704 openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the… CWE-916
- CVE-2026-81689 openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted… CWE-916
- CVE-2026-75112 A security issue exists within OTTO® Fleet Manager. CWE-916
- CVE-2026-74871 openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR… CWE-916