CVE-2026-9638: Crypt::PBKDF2 Insecure Salt Generation (CVSS 7.5)

Technical summary

The vulnerability stems from improper random number generation (CWE-338). PBKDF2 requires cryptographically secure random salts to ensure each password hash is distinct and resistant to precomputation attacks. Crypt::PBKDF2 before version 0.261630 derives salts from Perl's rand() function, which is seeded from predictable sources and designed for statistical randomness, not cryptographic unpredictability. An attacker with knowledge of the seeding mechanism or state can reproduce the same salts and use precomputed rainbow tables or optimized crack attempts against the hashed passwords. The vulnerability affects confidentiality of password hashes; integrity and availability are not directly impacted.

Business impact

Applications relying on Crypt::PBKDF2 for password storage are exposed to accelerated credential compromise. If an attacker obtains a database of password hashes generated by vulnerable versions, they can use predicted salts to execute dictionary and brute-force attacks far more efficiently than intended. This enables account takeovers, lateral movement, and potential regulatory violations if the application stores personal data covered by privacy laws (GDPR, CCPA, HIPAA). Organizations using this library in authentication, session management, or secrets derivation should treat this as a high-priority patching incident.

Affected systems

Any Perl application using Crypt::PBKDF2 version 0.261629 or earlier is affected. This includes web applications, command-line tools, system utilities, and services that rely on this library for password hashing or cryptographic key derivation. The vulnerable library is available on CPAN (Comprehensive Perl Archive Network) and may be installed as a direct dependency or as a transitive dependency of other Perl modules. Systems should be inventoried to identify all instances of this package and its dependents.

Exploitability

The vulnerability requires the attacker to obtain password hashes (via database breach, configuration leak, or memory dump), but does not require authentication, network interaction during exploitation, or user interaction. Once hashes are obtained, exploitation is straightforward: an attacker can predict salts and apply precomputed or optimized cracking techniques. There is no known public exploit code, and the vulnerability is not yet on CISA's Known Exploited Vulnerabilities list; however, the technical barrier to exploitation is low and the impact is severe.

Remediation

Upgrade Crypt::PBKDF2 to version 0.261630 or later. This version corrects salt generation to use cryptographically secure random sources (typically Crypt::OpenSSL::Random or Crypt::Random on most Perl installations). After patching, consider regenerating password hashes for existing users during their next login or via a scheduled re-hashing process. Organizations should audit logs to determine if passwords were exposed during the window when vulnerable versions were in use.

Patch guidance

Update Crypt::PBKDF2 to version 0.261630 or later using your package manager (cpan, cpanm, or your distribution's Perl module repository). Verify the updated version is installed: perl -e 'use Crypt::PBKDF2; print $Crypt::PBKDF2::VERSION' should report 0.261630 or higher. Test your application thoroughly in a staging environment before deploying to production, as cryptographic library updates can occasionally affect serialization or compatibility. Once patched, ensure new password hashes use the corrected salt generation; consider a phased re-hashing of existing hashes as users log in.

Detection guidance

Identify installed Perl modules: use cpan or cpanm to list installed versions of Crypt::PBKDF2. On systems with package managers, grep /usr/share/perl or search cpan.org for installed version metadata. If source code is available, search for use Crypt::PBKDF2 in .pm and .pl files. Monitor Perl error logs and application startup logs for any deprecation warnings related to rand(). Consider a configuration management scan (Puppet, Ansible, Chef) to detect vulnerable versions across infrastructure. Correlate module installation timestamps with password hash creation dates to estimate exposure window.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (7.5), direct impact on password security, and the low effort required to exploit once hashes are obtained. While not yet in CISA's KEV list, the technical simplicity and widespread use of PBKDF2 in authentication systems make this a strong candidate for active exploitation. Organizations that have experienced any credential breach or have customer-facing authentication systems should prioritize this patch within days, not weeks.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication or user interaction required for an attacker to prepare an exploit, combined with high confidentiality impact (C:H). The attack complexity is low because predicting salts requires only knowledge of Perl's rand() implementation and potentially the seeding state. Integrity and availability are not impacted (I:N, A:N), preventing a critical rating. The severity is elevated by the ubiquity of password authentication and the fact that compromise of stored hashes can lead to widespread account takeovers.

Frequently asked questions