PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9641 ARODLAND CVE debrief

CVE-2026-9641 is a medium-severity vulnerability (CVSS Score: 5.3) affecting Crypt::PBKDF2 versions before 0.261630 for Perl. The vulnerability stems from the use of a weak default algorithm (HMAC-SHA1) and a low number of iterations (1000). HMAC-SHA1 is considered suitable only for legacy systems. Depending on the chosen algorithm, 220,000 to 1,400,000 iterations are recommended.

Vendor
ARODLAND
Product
Crypt::PBKDF2
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-14
Advisory published
2026-06-12
Advisory updated
2026-06-14

Who should care

Developers and administrators using Crypt::PBKDF2 for password storage in Perl applications should be aware of this vulnerability. The default configuration of affected versions may not provide adequate security for password storage.

Technical summary

The vulnerability is characterized by the following: A CVSS score of 5.3, indicating a medium severity. The vulnerability affects Crypt::PBKDF2 versions before 0.261630. The default algorithm used is HMAC-SHA1, which is recommended only for legacy systems. The default number of iterations is 1000, which is lower than recommended. Recommended iterations range from 220,000 to 1,400,000 depending on the algorithm.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade to Crypt::PBKDF2 version 0.261630 or later.
  • Configure a stronger algorithm (e.g., HMAC-SHA256) if possible.
  • Increase the number of iterations to at least 220,000, or ideally 1,400,000 if the algorithm supports it.
  • Refer to [ref-4](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2) for password storage best practices.

Evidence notes

The CVE record [cve-org] provides official details about the vulnerability. The National Vulnerability Database (NVD) [nvd] offers additional information and analysis. For more context on password storage best practices, refer to the OWASP Password Storage Cheat Sheet [ref-4].

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9641 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9641

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9641 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9641

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changes

    9b29abf9-4ab0-4765-b253-1875cd9b441e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.