Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-9641 is a medium-severity Use of Password Hash With Insufficient Computational Effort (CWE-916) vulnerability. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Cracking (T1110.002); ranked at the 13th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-36470
Vulnerability Data
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm,…
more
220,000 to 1,400,000 iterations should be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Weak PBKDF2 defaults enable offline password cracking of stored hashes.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires selection and use of approved cryptographic algorithms and parameters (e.g., PBKDF2 with strong hash and high iteration count) instead of the weak HMAC-SHA1/1000-iteration defaults.
Mandates timely installation of updates that replace the vulnerable Crypt::PBKDF2 defaults with secure iteration counts and algorithms.
Requires configuring the module's algorithm and iteration parameters to organizationally approved values that exceed the weak library defaults.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper password hashing is a direct instance of using cryptographic hashes to protect data-at-rest.
Secure development practices explicitly include selection and configuration of strong, computationally expensive password hashes.
Authentication policies may reference password handling but do not address storage or computational cost of hashes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires secure handling of authentication information, which includes choosing strong password hashing schemes.
Requires appropriate use of cryptography, which encompasses selecting strong hashing algorithms for passwords.
Secure coding practices include implementing password storage with adequate computational effort.
Mandates secure authentication mechanisms, directly addressing the need for computationally strong password hashes.