CVE-2026-8721

Critical

Description

Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.

SeverityCritical

CVSS9.8

Exploit probability—

ProductCrypt::OpenSSL::PKCS12

PublishedMay 17, 2026

First seenMay 17, 2026

Weakness typeCWE-170CWE-170

How to fix

Vendor advisories

metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.95/view/Changes.md

Affected products

Product	Affected versions	Fixed in
JONASBN Crypt::OpenSSL::PKCS12	v ≤ 1.94	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.