[<prev] [next>] [day] [month] [year] [list]
Message-Id: <F409C898-0484-4CA7-84D7-DBA09CC58BB5@stig.io>
Date: Wed, 13 May 2026 14:43:32 +0200
From: Stig Palmquist <stig@...g.io>
To: cve-announce@...urity.metacpan.org,
oss-security@...ts.openwall.com
Subject: CVE-2026-8463: Crypt::Argon2 versions from 0.017 before 0.031 for
Perl perform a heap out-of-bounds read in argon2_verify on empty encoded
input
========================================================================
CVE-2026-8463 CPAN Security Group
========================================================================
CVE ID: CVE-2026-8463
Distribution: Crypt-Argon2
Versions: from 0.017 before 0.031
MetaCPAN: https://metacpan.org/dist/Crypt-Argon2
VCS Repo: https://github.com/Leont/crypt-argon2
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap
out-of-bounds read in argon2_verify on empty encoded input
Description
-----------
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap
out-of-bounds read in argon2_verify on empty encoded input.
The auto-detect form of argon2_verify passes encoded_len - 1 as the
length argument to memchr without checking that encoded_len is
non-zero. When the encoded string is empty, the size_t subtraction
underflows to SIZE_MAX and memchr scans adjacent heap memory looking
for a '$' separator byte.
A caller that invokes argon2_verify against a stored hash that may
legitimately be empty (for example a placeholder row or a NULL column
materialised as an empty string) reads out-of-bounds heap memory, which
can crash the process or leak the position of an adjacent '$' byte into
subsequent parsing.
Problem types
-------------
- CWE-126 Buffer Over-read
- CWE-191 Integer Underflow (Wrap or Wraparound)
Solutions
---------
Upgrade to Crypt-Argon2 0.031 or later.
References
----------
https://github.com/Leont/crypt-argon2/commit/92eac03ce63d541e0ead7ea5a89b9b67ce0c0e64.patch
https://metacpan.org/release/LEONT/Crypt-Argon2-0.031/changes
Timeline
--------
- 2026-05-12: Issue reported.
- 2026-05-13: Crypt-Argon2 0.031 released with fix.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
