CVE-2026-9641: Crypt::PBKDF2 Weak Cryptography Vulnerability

CVE-2026-9641 Overview

CVE-2026-9641 affects Crypt::PBKDF2 versions before 0.261630 for Perl. The module ships with weak cryptographic defaults that reduce the cost of offline password cracking. By default, the library uses HMAC-SHA1 as the pseudorandom function and only 1000 iterations. HMAC-SHA1 is only appropriate for legacy compatibility, and current guidance from the OWASP Password Storage Cheat Sheet recommends between 220,000 and 1,400,000 iterations depending on the hash algorithm selected. Applications relying on these defaults produce password hashes that are significantly cheaper to brute force than modern standards require. The weakness is classified under [CWE-916] for use of password hashing with insufficient computational effort.

Critical Impact
Password hashes generated with the default Crypt::PBKDF2 configuration are vulnerable to accelerated offline brute-force and dictionary attacks, exposing user credentials if a hash database is leaked.

Affected Products

Crypt::PBKDF2 Perl module versions prior to 0.261630
Perl applications relying on the module's default constructor parameters
Downstream packages and distributions bundling vulnerable releases

Discovery Timeline

2026-06-12 - CVE-2026-9641 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-9641

Vulnerability Analysis

Password-Based Key Derivation Function 2 (PBKDF2) derives keys from passwords by applying a pseudorandom function repeatedly with a salt. The security of PBKDF2 against offline attacks depends directly on two factors: the strength of the underlying pseudorandom function and the iteration count.

Crypt::PBKDF2 versions before 0.261630 configure both factors below current cryptographic guidance. The module defaults to HMAC-SHA1, an algorithm OWASP categorizes as suitable only for FIPS-140 legacy compatibility. It also defaults to 1000 iterations, two to three orders of magnitude below the recommended floor.

An attacker who obtains a database of password hashes generated with these defaults can use commodity GPU hardware to test billions of password candidates per second. The low iteration count provides little computational friction. The result is that previously "hashed" credentials become recoverable in practical timeframes for any password short of a long random string.

Root Cause

The root cause is insecure default configuration in the library's constructor. Developers calling Crypt::PBKDF2->new() without explicit hash_class and iterations arguments inherit the legacy defaults. This violates the principle of secure-by-default cryptographic libraries.

Attack Vector

Exploitation is offline and depends on prior access to stored hashes through unrelated compromise such as SQL injection, backup theft, or insider access. Once obtained, hashes generated with the defaults are processed through standard tools such as hashcat or john configured for the pbkdf2-hmac-sha1 mode at 1000 iterations. There is no network-facing exploit primitive in the library itself. The vulnerability manifests in the strength of the resulting hash, not in remote code execution. Technical details are documented in the MetaCPAN Crypt-PBKDF2 Changes release notes.

Detection Methods for CVE-2026-9641

Indicators of Compromise

Stored PBKDF2 hashes carrying an HMAC-SHA1 algorithm identifier and an iteration count of 1000
Application code instantiating Crypt::PBKDF2->new() without overriding hash_class or iterations
Dependency manifests pinning Crypt::PBKDF2 to versions earlier than 0.261630

Detection Strategies

Inventory Perl applications and CPAN dependencies to identify any use of Crypt::PBKDF2 below 0.261630
Audit source repositories with static analysis for calls to Crypt::PBKDF2->new lacking explicit algorithm and iteration arguments
Sample stored credential records to verify the algorithm identifier and iteration count embedded in PBKDF2 output strings

Monitoring Recommendations

Monitor authentication backends for bulk read access to credential tables, which often precedes offline cracking attempts
Track software bill of materials (SBOM) data to flag deployments of the vulnerable module version
Alert on anomalous credential-stuffing or password-spray patterns that may indicate successful offline recovery of weak hashes

How to Mitigate CVE-2026-9641

Immediate Actions Required

Upgrade Crypt::PBKDF2 to version 0.261630 or later across all Perl environments
Explicitly configure the constructor with a strong algorithm such as HMACSHA2 and an iteration count aligned with OWASP guidance
Re-hash stored passwords on next successful user login using the strengthened parameters
Treat any credential database created with the legacy defaults as potentially compromised and plan a password reset cycle if exposure is suspected

Patch Information

The fix is delivered in Crypt::PBKDF2 version 0.261630, which updates the documented defaults and guidance. Refer to the MetaCPAN Crypt-PBKDF2 Changes for the full changelog and to the Open Wall OSS Security Update 2026-06-12 thread for distributor coordination details.

Workarounds

Override defaults at every call site by passing hash_class => 'HMACSHA2', hash_args => { sha_size => 512 }, and iterations => 600000 or higher
Wrap the library in an internal helper module that enforces approved parameters and rejects insecure overrides
Where re-hashing is not yet possible, layer additional protections such as encrypted hash storage and strict access controls on credential tables

bash

# Configuration example: enforce strong PBKDF2 parameters in Perl
# cpanm Crypt::PBKDF2@0.261630
#
# use Crypt::PBKDF2;
# my $pbkdf2 = Crypt::PBKDF2->new(
#     hash_class => 'HMACSHA2',
#     hash_args  => { sha_size => 512 },
#     iterations => 600000,
#     output_len => 32,
# );