Home

Description

Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available. The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available.

PUBLISHED Reserved 2026-05-14 | Published 2026-05-26 | Updated 2026-05-28 | Assigner CPANSec

Problem types

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator

Product status

Default status
unaffected

Any version
affected

Timeline

2026-05-13:Issue reported to CPANSec
2026-05-14:Issue reported to maintainer
2026-05-16:Version 0.011 with fix released.

References

www.openwall.com/lists/oss-security/2026/05/26/8

metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/changes release-notes

metacpan.org/...ryptKDF-0.011/diff/MIK/Crypt-ScryptKDF-0.010

cve.org (CVE-2026-8647)

nvd.nist.gov (CVE-2026-8647)

Download JSON