CVE-2026-9638 Details

A vulnerability exists in Crypt::PBKDF2 versions prior to 0.261630 for Perl, where the random values generated for salts are insecure. These versions rely on Perl's built-in rand function, which is predictable and not suitable for cryptographic purposes. This flaw can compromise the effectiveness of the PBKDF2 password hashing algorithm by making it easier for attackers to perform brute-force attacks on hashed passwords.

Users can upgrade to Crypt::PBKDF2 version 0.261630 or later, which addresses this vulnerability by using Crypt::URandom to generate salts, ensuring a more secure and unpredictable random value.