CVE-2026-9641 Details
Description
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.
A vulnerability exists in Crypt::PBKDF2 versions prior to 0.261630 for Perl, where the default algorithm and number of iterations for password hashing are inadequate. The library defaults to HMAC-SHA1, suitable only for legacy systems, and uses just 1000 iterations. For optimal security, 220,000 to 1,400,000 iterations should be applied, depending on the chosen algorithm.
Users can upgrade to Crypt::PBKDF2 version 0.261630 or later, which addresses this vulnerability by changing the default algorithm to HMAC-SHA256 and increasing the number of iterations to 600,000.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Crypt::PBKDF2 | < 0.261630 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 14, 2026 | CVE Modified | CVE |
| Jun 14, 2026 | CVE Modified | CVE |
| Jun 13, 2026 | CVE Modified | CVE |
| Jun 12, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | CVE Modified | CVE |
| Jun 12, 2026 | New CVE Received | CPANSec |