CVE-2026-8721
CriticalSummary
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which leads to the loss of password length in Perl.
Risk Assessment
Organizations may be at risk of losing password entropy, potentially weakening data security. Users may be unaware that their passwords are incomplete.
Recommendation
It is recommended to upgrade to the latest version of Crypt::OpenSSL::PKCS12 to avoid issues with password truncation. A password audit should also be conducted to ensure their integrity.
Other vulnerabilities in Crypt::OpenSSL::PKCS12
See all- CVE-2026-9265Critical
Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl allow a heap OOB read in print_attribute for UTF8STRING attributes. The print_attribute() function copies an ASN.1 attribute value into a memory buffer without adding a NUL terminator, leading to unsafe reads of adjacent bytes.
- CVE-2026-8507Critical
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When parsing a PKCS12 file with a >= 1 GiB OCTET STRING (or BIT STRING) attribute, a heap out-of-bounds write could be triggered, leading to remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().
- CVE-2026-17510High
In the Crypt::OpenSSL::PKCS12 library for Perl before version 1.98, there is a NULL pointer dereference vulnerability in the print_attribute function when handling a zero-length BMPSTRING attribute. The zero length causes the buffer to be freed and return NULL, and a subsequent strlen call on that pointer crashes the process.
Original NVD description (English source)
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS