CVE-2026-9641

CVE-2026-9641: Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations

Vendor Arodland

Product Crypt::PBKDF2

Weakness CWE-916

Published June 12, 2026

Last update June 14, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.

Key dates

02Disclosure timeline

June 12, 2026 CVE published

June 14, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-9641 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/916.html

Related vulnerabilities

CVE-2026-9641: Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations

01Description

02Disclosure timeline

03References

04Related CVE