CVE-2026-8721 Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs
Attackers can bypass password protection in PKCS12 files because the library truncates passwords at NULL bytes, reducing entropy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8721?
CVE-2026-8721 is a critical vulnerability in JONASBN Crypt::OpenSSL::PKCS12, published on 17 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs.
Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded.
The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.
Weakness: CWE-170
Which versions are affected by CVE-2026-8721?
How do I fix CVE-2026-8721?
Upgrade to a fixed version.
Is CVE-2026-8721 being exploited?
There is no known exploitation of CVE-2026-8721 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-8721, GHSA-hh8h-hxcj-2pm7, UBUNTU-CVE-2026-8721.