Password Truncation Issue in Crypt::OpenSSL::PKCS12 Product by Perl

CVE-2026-8721

What is CVE-2026-8721?

The Crypt::OpenSSL::PKCS12 module for Perl has a significant vulnerability that affects how password parameters are handled. Specifically, when passwords contain embedded NULL characters, the module truncates these passwords without warning, leading to potential information loss and reduced security. The root of the issue lies in the type declaration of password parameters, which is set to char *. This allows passwords to be processed incorrectly, as the length is disregarded, causing any bytes following the first NULL to be silently discarded. This issue presents a serious risk for users relying on binary, key derivation function (KDF), or HMAC-derived passwords, as the truncation compromises their entropy and overall effectiveness.

References