CVE-2025-15638

Critical

Description

Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437.

SeverityCritical

CVSS10.0

Exploit probability—

ProductAtrodo Net\

PublishedApr 21, 2026

First seenApr 21, 2026

Weakness typeCWE-1395CWE-1395

How to fix

Update

atrodo net\0.14 or later

Vendor advisories

cve.org/CVERecord?id=CVE-2016-6129
cve.org/CVERecord?id=CVE-2018-12437
metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changes

Affected products

Product	Affected versions	Fixed in
atrodo net\	\ ≤ v < 0.14	0.14

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.