CVE-2026-8647
Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
4th
Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available. The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available.
| CWE | CWE-338 |
| Vendor | mik |
| Product | crypt::scryptkdf |
| Published | May 26, 2026 |
| Last Updated | May 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for mik crypt::scryptkdf
Be the first to know when new medium vulnerabilities affecting mik crypt::scryptkdf are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
MIK / Crypt::ScryptKDF
0 ≤ 0.010