The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| MIK | Crypt::ScryptKDF | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to version 0.011 or later.
Vendor Workaround
Install one of the recommended Perl modules, such as Crypt::PRNG.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 26 May 2026 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available. The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available. | |
| Title | Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available | |
| Weaknesses | CWE-338 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-05-26T22:53:49.993Z
Reserved: 2026-05-14T22:46:50.791Z
Link: CVE-2026-8647
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-26T23:16:21.247
Modified: 2026-05-26T23:16:21.247
Link: CVE-2026-8647
Redhat
No data.
OpenCVE Enrichment
No data.