# CVE-2026-9641

## Summary

- **CVE ID:** CVE-2026-9641
- **Severity:** MEDIUM
- **CVSS Score:** 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **CWE:** CWE-916
- **Published:** Jun 12, 2026
- **Last Modified:** Jun 14, 2026

## Description

Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations.

The default algorithm is HMAC-SHA1, which should only be used for legacy systems.

These versions default to using 1000 iterations.

Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.

## Affected Products

- ARODLAND — Crypt::PBKDF2 (0)

## References

- [CNA](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2)
- [CNA](https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changes)
- [CVE](http://www.openwall.com/lists/oss-security/2026/06/12/5)
- [CVE](http://www.openwall.com/lists/oss-security/2026/06/13/1)
- [CVE](http://www.openwall.com/lists/oss-security/2026/06/14/1)
- [CVE](http://www.openwall.com/lists/oss-security/2026/06/14/2)
- [CVE](http://www.openwall.com/lists/oss-security/2026/06/14/3)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.23%
- **EPSS Percentile:** 13.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._