CVE-2026-9641
5.3
MEDIUM
CVSS 3.1
Description
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.
How to fix CVE-2026-9641
No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.
- Debian/libcrypt-pbkdf2-perl—no fix listed
Is CVE-2026-9641 being exploited?
No exploitation signal available. Neither CISA KEV nor a current EPSS score has been published for CVE-2026-9641.
Affected packages (1)
- from 0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| nvd | CVSS 3.1 | MEDIUM5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |