CVE-2026-9638: Arodland crypt::pbkdf2

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Affected products

• Arodland crypt::pbkdf2: before 0.261630 (fixed in 0.261630)

Published 2026-06-12. Last modified 2026-06-17.