Crypt::PBKDF2 modules prior to version 0.261630 use Perl’s built‑in eq operator to compare derived keys, which introduces timing differences that an attacker can observe. The vulnerability therefore allows a timing side‑channel attack that can reveal portions of the derived key material. This loss of secrecy undermines any processes that depend on the confidentiality of those keys.

The Perl Crypt::PBKDF2 distribution from the ARODLAND vendor, versions before 0.261630, is affected.

The flaw is a timing side‑channel; an attacker must be able to repeatedly invoke the comparison. The CVE description does not specify the exact attack vector, so it is inferred that the attack could be performed locally or remotely if PBKDF2 is used in an authentication or other remote service that exposes the comparison. EPSS data is not available, and there is no KEV listing, but the lack of a public exploit does not preclude potential use of the side‑channel. The CVSS score of 5.9 indicates a moderate severity, and combined with the potential to reconstruct a derived key via timing, represents a notable risk. No elevated privileges are required beyond the ability to invoke the comparison function.