CVE-2026-8647 Details
Description
Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available. The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available.
A vulnerability exists in Crypt::ScryptKDF versions prior to 0.010 for Perl, where the module relies on an insecure random number source when no cryptographically secure random number generator (CSPRNG) module is available. The random_bytes function defaulted to the built-in rand() function, which is not secure, if none of the following Perl modules were installed: Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure.
Users can update to Crypt::ScryptKDF version 0.011 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 26, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/changes | CPANSec | Release NotesVendor |
| https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/diff/MIK/Crypt-ScryptKDF-0.010#lib/Crypt/ScryptKDF.pm | CPANSec | Source CodeVendor |
| http://www.openwall.com/lists/oss-security/2026/05/26/8 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Crypt::ScryptKDF | <= 0.010 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CVE |
| May 26, 2026 | New CVE Received | CPANSec |