The default algorithm is HMAC-SHA1, which should only be used for legacy systems.
These versions default to using 1000 iterations.
Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ARODLAND | Crypt::PBKDF2 | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to version 0.261630 or later.
Workaround
Change the default algorithm to something stronger, such as "HMACSHA2", and the output_len accordingly (32 for SHA256). The number of iterations should also be increased (600,000 for SHA256, for example).
Fri, 12 Jun 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used. | |
| Title | Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations | |
| Weaknesses | CWE-916 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-06-12T17:50:44.533Z
Reserved: 2026-05-26T18:44:37.132Z
Link: CVE-2026-9641
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-06-12T16:16:35.047
Modified: 2026-06-12T16:17:58.070
Link: CVE-2026-9641
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-06-12T16:45:07Z