CVE-2026-9638 Overview
CVE-2026-9638 affects the Crypt::PBKDF2 Perl module in versions prior to 0.261630. The module generates salts using Perl's built-in rand function, which is not cryptographically secure. The rand function produces predictable, deterministic output unsuitable for cryptographic operations. Attackers who can predict or reproduce salt values can accelerate offline password cracking against PBKDF2-derived hashes. The flaw is classified under CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator.
Critical Impact
Predictable salts undermine PBKDF2 password hashing, enabling precomputation attacks and weakening confidentiality protections for stored credentials across any application relying on this Perl module.
Affected Products
- Crypt::PBKDF2 Perl module versions before 0.261630
- Perl applications consuming Crypt::PBKDF2 for password hashing
- Downstream distributions packaging the vulnerable module
Discovery Timeline
- 2026-06-12 - CVE-2026-9638 published to NVD and disclosed via OpenWall OSS Security
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-9638
Vulnerability Analysis
The Crypt::PBKDF2 module implements the Password-Based Key Derivation Function 2 (PBKDF2) algorithm in Perl. PBKDF2 relies on per-password salt values to defeat precomputation attacks such as rainbow tables. The security of this construction depends on the salt being unpredictable.
In versions prior to 0.261630, the module sources salt bytes from Perl's core rand function. Perl's rand is a non-cryptographic pseudo-random number generator seeded from low-entropy sources. Attackers who observe sufficient output, or who can guess seed state, can reproduce subsequent salts.
When salts are predictable, adversaries can precompute PBKDF2 hashes against candidate passwords. Credential databases stolen from applications using the vulnerable module become significantly easier to crack offline.
Root Cause
The root cause is the use of rand in the salt generation routine in lib/Crypt/PBKDF2.pm. The reference implementation referenced at MetaCPAN Crypt-PBKDF2 source lines 86–93 shows the call into the standard pseudo-random generator rather than a cryptographically secure source such as /dev/urandom or Crypt::URandom.
Attack Vector
The attack vector is network-adjacent and offline. An attacker first obtains a credential store, for example through a separate database compromise or backup exposure. With predictable salts, the attacker reconstructs salt values for targeted accounts and runs accelerated dictionary or brute-force attacks. The vulnerability does not yield direct remote code execution; it weakens stored credential confidentiality.
The vulnerability manifests in the salt generation routine of Crypt::PBKDF2. See the MetaCPAN source reference and the change log for 0.261630 for the exact code change replacing rand with a cryptographically secure source.
Detection Methods for CVE-2026-9638
Indicators of Compromise
- Presence of Crypt::PBKDF2 modules with version strings below 0.261630 in installed Perl library paths
- Application logs referencing PBKDF2 hashing operations from Perl runtimes using outdated CPAN dependencies
- Credential dump artifacts containing PBKDF2 hashes with short or low-entropy salt fields
Detection Strategies
- Inventory installed Perl modules with cpanm --info Crypt::PBKDF2 or perl -MCrypt::PBKDF2 -e 'print $Crypt::PBKDF2::VERSION' across servers
- Scan source repositories and cpanfile, Makefile.PL, and Build.PL manifests for unpinned or vulnerable Crypt::PBKDF2 dependencies
- Audit stored password hashes for repeated or low-entropy salt values that indicate predictable generation
Monitoring Recommendations
- Track CPAN dependency updates in CI pipelines and alert on installations of Crypt::PBKDF2 below 0.261630
- Monitor authentication services written in Perl for unusual offline credential validation failures that may follow a breach
- Correlate file integrity monitoring on lib/Crypt/PBKDF2.pm with software bill of materials (SBOM) data to flag legacy versions
How to Mitigate CVE-2026-9638
Immediate Actions Required
- Upgrade Crypt::PBKDF2 to version 0.261630 or later on all systems
- Rotate any password hashes generated by the vulnerable version by forcing user re-authentication and rehashing on next login
- Audit downstream applications and packaged distributions for transitive dependencies on the vulnerable module
Patch Information
The maintainer released Crypt::PBKDF2 version 0.261630, which replaces the insecure rand call with a cryptographically secure random source. Refer to the official change log for full details. Install the fixed release via cpanm Crypt::PBKDF2@0.261630 or your distribution's package manager.
Workarounds
- Replace direct calls to Crypt::PBKDF2 salt generation with a custom salt sourced from Crypt::URandom or /dev/urandom until the upgrade is applied
- Pin Crypt::PBKDF2 to a known-good version in cpanfile to prevent regression to vulnerable releases
- Restrict access to stored credential databases and enforce defense-in-depth controls such as pepper values held outside the database
# Upgrade Crypt::PBKDF2 to the fixed release
cpanm Crypt::PBKDF2@0.261630
# Verify installed version
perl -MCrypt::PBKDF2 -e 'print "$Crypt::PBKDF2::VERSION\n"'
# Pin the dependency in cpanfile
echo "requires 'Crypt::PBKDF2', '>= 0.261630';" >> cpanfile
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
