Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

CVE-2026-9641 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceCVE-2026-9641

CVE-2026-9641

MEDIUM5.3

Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations

Published Jun 12, 2026

Modified 1 weeks ago

Details

Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations.

The default algorithm is HMAC-SHA1, which should only be used for legacy systems.

These versions default to using 1000 iterations.

Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.

References

WEB

http://www.openwall.com/lists/oss-security/2026/06/12/5

WEB

http://www.openwall.com/lists/oss-security/2026/06/13/1

WEB

http://www.openwall.com/lists/oss-security/2026/06/14/1

WEB

http://www.openwall.com/lists/oss-security/2026/06/14/2

WEB

http://www.openwall.com/lists/oss-security/2026/06/14/3

WEB

https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2

WEB

https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changes

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-9641

CVSS Analysis

CVSS v3.1

5.3

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

NoneI:N

Availability

NoneA:N

5.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

Other

CWE-916

Ecosystems

Timeline

PublishedJun 12, 2026

ModifiedJun 14, 2026