PT-2026-48921 · Cpan · Crypt::Pbkdf2

Robert Rothenberg · CVE-2026-9641 · Published 2026-06-12 · Updated 2026-06-15

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Crypt::PBKDF2 versions prior to 0.261630

Description The software uses a weak default algorithm and an insufficient number of iterations. The default algorithm is HMAC-SHA1, which is intended only for legacy systems. Additionally, the default configuration uses 1000 iterations, whereas 220,000 to 1,400,000 iterations are recommended depending on the selected algorithm.

Recommendations Update to version 0.261630 or later.

Exploit

Fix

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2026-9641

OPENSUSE-SU-2026:11034-1

Affected Products

Crypt::Pbkdf2

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9641.json · Exploit
• https://cve.org/CVERecord?id=CVE-2026-9641 · Security Note
• https://osv.dev/vulnerability/CVE-2026-9641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9641 · Security Note
• https://ubuntu.com/security/CVE-2026-9641 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-9641 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-9641 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11034-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-9641 · Vendor Advisory
• https://github.com/arodland/Crypt-PBKDF2 · Note
• https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2 · Note
• http://openwall.com/lists/oss-security/2026/06/14/3 · Note
• http://openwall.com/lists/oss-security/2026/06/12/5 · Note
• https://suse.com/security/cve/CVE-2017-20240 · Note
• https://t.me/CVEtracker/56718 · Telegram Post