CVE catalog

CVE-2026-8721

DEBIAN-CVE-2026-8721

[CVE catalog]

Severity
Unknown · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.45% · Oct 25, 2026

Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibcrypt-openssl-pkcs12-perl131.94-1vulnerable
Debianlibcrypt-openssl-pkcs12-perl131.95-1vulnerable
Debianlibcrypt-openssl-pkcs12-perl131.96-1vulnerable
Debianlibcrypt-openssl-pkcs12-perl131.97-1vulnerable
Debianlibcrypt-openssl-pkcs12-perl131.98-1vulnerable
Debianlibcrypt-openssl-pkcs12-perl131.99-1vulnerable
Debianlibcrypt-openssl-pkcs12-perl141.94-1vulnerable
Debianlibcrypt-openssl-pkcs12-perl141.95-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibcrypt-openssl-pkcs12-perldeb141.95-1Not reportedDEBIAN-CVE-2026-8721Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

Observed:

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]