CVE-2026-8647

Published: May 26, 2026Modified: Jul 23, 2026Deferred

4.8

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.2 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available. The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available.

Related CWEs

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

References (3)

https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/changes

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/diff/MIK/Crypt-ScryptKDF-0.010#lib/Crypt/ScryptKDF.pm

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

http://www.openwall.com/lists/oss-security/2026/05/26/8

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.