CVE-2026-8463 Details
Description
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input. The auto-detect form of argon2_verify passes encoded_len - 1 as the length argument to memchr without checking that encoded_len is non-zero. When the encoded string is empty, the size_t subtraction underflows to SIZE_MAX and memchr scans adjacent heap memory looking for a '$' separator byte. A caller that invokes argon2_verify against a stored hash that may legitimately be empty (for example a placeholder row or a NULL column materialised as an empty string) reads out-of-bounds heap memory, which can crash the process or leak the position of an adjacent '$' byte into subsequent parsing.
A heap out-of-bounds read vulnerability has been identified in Crypt::Argon2 versions 0.017 prior to 0.031 for Perl. The issue arises in the argon2_verify function when it processes empty encoded input. The auto-detect feature of argon2_verify incorrectly passes a length of encoded_len - 1 to the memchr function without verifying that encoded_len is greater than zero. This oversight causes a buffer underflow, resulting in memchr scanning adjacent heap memory for a '$' separator byte. Consequently, if argon2_verify is called with a stored hash that is legitimately empty, it can lead to reading out-of-bounds heap memory, potentially crashing the process or leaking information about adjacent memory into subsequent operations.
Users can upgrade to Crypt::Argon2 version 0.031 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Leont/crypt-argon2/commit/92eac03ce63d541e0ead7ea5a89b9b67ce0c0e64.patch | CPANSec | Patch |
| https://metacpan.org/release/LEONT/Crypt-Argon2-0.031/changes | CPANSec | Release Notes |
| http://www.openwall.com/lists/oss-security/2026/05/13/4 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-126 | Buffer Over-read | CPANSec |
| CWE-191 | Integer Underflow (Wrap or Wraparound) | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| leont crypt::argon2 | >= 0.017, < 0.031 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | CVE Modified | CVE |
| May 13, 2026 | New CVE Received | CPANSec |