Insecure Random Number Generation in Crypt::ScryptKDF Library by Perl

CVE-2026-8647

What is CVE-2026-8647?

The Crypt::ScryptKDF library for Perl versions up to 0.010 utilizes a weak random number generator when secure alternatives are unavailable. Specifically, it defaults to the built-in rand() function instead of using a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). This poses significant security implications for applications relying on this library for secure password derivation, rendering them vulnerable to potential exploits due to predictability in randomization.

References