CVE-2026-8463 Integer overflow in Crypt::Argon2
An attacker can cause a crash or leak heap memory by providing empty input to the argon2_verify function in the Crypt::Argon2 Perl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8463?
CVE-2026-8463 is a medium-severity vulnerability in LEONT Crypt::Argon2, published on 13 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input.
The auto-detect form of argon2_verify passes encoded_len - 1 as the length argument to memchr without checking that encoded_len is non-zero. When the encoded string is empty, the size_t subtraction underflows to SIZE_MAX and memchr scans adjacent heap memory looking for a '$' separator byte.
A caller that invokes argon2_verify against a stored hash that may legitimately be empty (for example a placeholder row or a NULL column materialised as an empty string) reads out-of-bounds heap memory, which can crash the process or leak the position of an adjacent '$' byte into subsequent parsing.
Which versions are affected by CVE-2026-8463?
It affects 1 product.
Products include Leont Crypt\.
How do I fix CVE-2026-8463?
Upgrade to a fixed version.
Is CVE-2026-8463 being exploited?
There is no known exploitation of CVE-2026-8463 in the wild and no public exploit code.
Other vulnerabilities in LEONT Crypt::Argon2
Sources
Also known as DEBIAN-CVE-2026-8463, GHSA-3p6c-7qjr-35x9, UBUNTU-CVE-2026-8463.