CVE-2026-8647 Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available
The Perl Crypt::ScryptKDF library uses insecure random numbers if CSPRNG modules are missing, weakening key derivation security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8647?
CVE-2026-8647 is a medium-severity vulnerability in MIK Crypt::ScryptKDF, published on 26 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available.
The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available.
Weakness: CWE-338
Which versions are affected by CVE-2026-8647?
How do I fix CVE-2026-8647?
No fix has been published for CVE-2026-8647 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-8647 being exploited?
There is no known exploitation of CVE-2026-8647 in the wild and no public exploit code.