Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks
CVE-2017-20240

Currently unrated

Key Information:

Vendor: Arodland
Status: Crypt::pbkdf2
Vendor: CVE Published:; 12 June 2026

🔔 Create Arodland Vulnerability Alert

What is CVE-2017-20240?

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks.

These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.

Affected Version(s)

Crypt::PBKDF2 0 < 0.261630

References

https://github.com/arodland/Crypt-PBKDF2/pull/6

https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.1615...

https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.2616...

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 12, 2026
Vulnerability Reserved
May 26, 2026

CVE-2017-20240 Data

.