CVE-2017-20240

CVE-2017-20240: Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks

Vendor Arodland

Product Crypt::PBKDF2

Weakness CWE-208

Published June 12, 2026

Last update June 12, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.

Key dates

02Disclosure timeline

June 12, 2026 CVE published

June 12, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2017-20240 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/208.html

Related vulnerabilities

04Related CVE

CVE-2025-9031 Timing-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web CVE-2026-48011 Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames CVE-2026-25597 PrestaShop has a time based enumeration in FO login form CVE-2023-25806 Time discrepancy in authentication responses in OpenSearch CVE-2026-23892 OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication