Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input.
The auto-detect form of argon2_verify passes encoded_len - 1 as the length argument to memchr without checking that encoded_len is non-zero. When the encoded string is empty, the size_t subtraction underflows to SIZE_MAX and memchr scans adjacent heap memory looking for a '$' separator byte.
A caller that invokes argon2_verify against a stored hash that may legitimately be empty (for example a placeholder row or a NULL column materialised as an empty string) reads out-of-bounds heap memory, which can crash the process or leak the position of an adjacent '$' byte into subsequent parsing.
References
| Link | Resource |
|---|---|
| https://github.com/Leont/crypt-argon2/commit/92eac03ce63d541e0ead7ea5a89b9b67ce0c0e64.patch | Patch |
| https://metacpan.org/release/LEONT/Crypt-Argon2-0.031/changes | Release Notes |
| http://www.openwall.com/lists/oss-security/2026/05/13/4 | Mailing List Third Party Advisory |
Configurations
History
13 May 2026, 19:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Leont/crypt-argon2/commit/92eac03ce63d541e0ead7ea5a89b9b67ce0c0e64.patch - Patch | |
| References | () https://metacpan.org/release/LEONT/Crypt-Argon2-0.031/changes - Release Notes | |
| References | () http://www.openwall.com/lists/oss-security/2026/05/13/4 - Mailing List, Third Party Advisory | |
| First Time |
Leont crypt\
Leont |
|
| CPE | cpe:2.3:a:leont:crypt\:\:argon2:*:*:*:*:*:perl:*:* |
13 May 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
13 May 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-13 14:18
Updated : 2026-05-13 19:23
NVD link : CVE-2026-8463
Mitre link : CVE-2026-8463
CVE.ORG link : CVE-2026-8463
JSON object : View
Products Affected
leont
- crypt\