PUBLISHED
2026-05-13 14:18
MODIFIED
2026-05-13 15:57
EPSS (Prob. Exploit)
0.33%
Top 74.2%
> DESCRIPTION
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input.
The auto-detect form of argon2_verify passes encoded_len - 1 as the length argument to memchr without checking that encoded_len is non-zero. When the encoded string is empty, the size_t subtraction underflows to SIZE_MAX and memchr scans adjacent heap memory looking for a '$' separator byte.
A caller that invokes argon2_verify against a stored hash that may legitimately be empty (for example a placeholder row or a NULL column materialised as an empty string) reads out-of-bounds heap memory, which can crash the process or leak the position of an adjacent '$' byte into subsequent parsing.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-126: Buffer Over-read - The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. | CWE-191: Integer Underflow (Wrap or Wraparound) - The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input
AFFECTED PACKAGES:
Unknown / Unknown
14 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
13/05/2026 14:18
Source: NVD
📊
ENRICHISSEMENT
01/06/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-126: Buffer Over-read - The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. | CWE-191: Integer Und...
Total des modifications: 1
Dernière mise à jour: 5 months ago