CVE-2026-8463 Affecting perl-crypt-argon2 package, versions <0.031-r0
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ALPINE324-PERLCRYPTARGON2-17302465
- published11 Jun 2026
- disclosed13 May 2026
Introduced: 13 May 2026
CVE-2026-8463 (opens in a new tab)How to fix?
Upgrade Alpine:3.24 perl-crypt-argon2 to version 0.031-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl-crypt-argon2 package and not the perl-crypt-argon2 package as distributed by Alpine.
See How to fix? for Alpine:3.24 relevant fixed versions and status.
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input.
The auto-detect form of argon2_verify passes encoded_len - 1 as the length argument to memchr without checking that encoded_len is non-zero. When the encoded string is empty, the size_t subtraction underflows to SIZE_MAX and memchr scans adjacent heap memory looking for a '$' separator byte.
A caller that invokes argon2_verify against a stored hash that may legitimately be empty (for example a placeholder row or a NULL column materialised as an empty string) reads out-of-bounds heap memory, which can crash the process or leak the position of an adjacent '$' byte into subsequent parsing.