CVE-2026-8721
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.
| CWE | CWE-170 |
| Vendor | jonasbn |
| Product | crypt::openssl::pkcs12 |
| Published | May 17, 2026 |
| Last Updated | May 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for jonasbn crypt::openssl::pkcs12
Be the first to know when new critical vulnerabilities affecting jonasbn crypt::openssl::pkcs12 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
JONASBN / Crypt::OpenSSL::PKCS12
0 ≤ 1.94