PT-2026-41583 · Cpan · Crypt::Openssl::Pkcs12

Published 2026-05-17 · Updated 2026-05-20 · CVE-2026-8721

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crypt::OpenSSL::PKCS12 versions prior to 1.95

Description The software truncates passwords containing embedded NULL characters. In the PKCS12.xs file, password parameters are declared as char *, which utilizes Perl's default typemap SvPV nolen, causing the Perl length to be discarded. Consequently, the C code or OpenSSL internally invokes the strlen() function on the buffer, resulting in any password bytes at or after the first NULL being silently dropped. This leads to a loss of entropy for binary, KDF-derived, or HMAC-derived passwords without any warnings.

Recommendations Update to version 1.95 or later.

Fix

Weakness Enumeration

CWE-170

Related Identifiers

CVE-2026-8721

Affected Products

Crypt::Openssl::Pkcs12

References · 19

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8721 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8721 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-8721 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-8721 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-8721 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-8721 · Security Note
• https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/d69393f3207586e3c6f2fe1a21b0b8972b93f8db · Note
• https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/468712ae04188342b263f057ad65f21a3545013b · Note
• https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/68904cd32691e223ad9eeff914812b8641eea14b · Note
• https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/7b90e88a97f0ebe440032b8116249d1004d7ca6f · Note
• https://lists.security.metacpan.org/cve-announce/msg/40149249 · Note
• https://t.me/cveNotify/163793 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/17/6 · Note
• https://twitter.com/VulmonFeeds/status/2056117980652593467 · Twitter Post
• https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.95/view/Changes.md · Note