CVE Explorer
CVE-2026-8647
Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available.
The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","packageName":"Crypt-ScryptKDF","product":"Crypt::ScryptKDF","programFiles":["lib/Crypt/ScryptKDF.pm"],"programRoutines":[{"name":"Crypt::ScryptKDF::random_bytes"}],"repo":"https://github.com/DCIT/perl-Crypt-ScryptKDF","vendor":"MIK","versions":[{"lessThanOrEqual":"0.010","status":"affected","version":"0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:056082c48a6728dd533ff9fb71c633278b5f24ac6b1309fe3973ab05ddf4afe7 · sha256:3e1aafc24de2aea9… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:056082c48a6728dd533ff9fb71c633278b5f24ac6b1309fe3973ab05ddf4afe7 · sha256:3e1aafc24de2aea9… · /containers/adp/1/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-338","description":"CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:056082c48a6728dd533ff9fb71c633278b5f24ac6b1309fe3973ab05ddf4afe7 · sha256:3e1aafc24de2aea9… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"url":"http://www.openwall.com/lists/oss-security/2026/05/26/8"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:056082c48a6728dd533ff9fb71c633278b5f24ac6b1309fe3973ab05ddf4afe7 · sha256:3e1aafc24de2aea9… · /containers/adp/0/references/0
{"tags":["release-notes"],"url":"https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/changes"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:056082c48a6728dd533ff9fb71c633278b5f24ac6b1309fe3973ab05ddf4afe7 · sha256:3e1aafc24de2aea9… · /containers/cna/references/0
{"url":"https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/diff/MIK/Crypt-ScryptKDF-0.010#lib/Crypt/ScryptKDF.pm"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:056082c48a6728dd533ff9fb71c633278b5f24ac6b1309fe3973ab05ddf4afe7 · sha256:3e1aafc24de2aea9… · /containers/cna/references/1
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.