CVE-2026-8463
Description
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input.
The auto-detect form of argon2_verify passes encoded_len - 1 as the length argument to memchr without checking that encoded_len is non-zero. When the encoded string is empty, the size_t subtraction underflows to SIZE_MAX and memchr scans adjacent heap memory looking for a '$' separator byte.
A caller that invokes argon2_verify against a stored hash that may legitimately be empty (for example a placeholder row or a NULL column materialised as an empty string) reads out-of-bounds heap memory, which can crash the process or leak the position of an adjacent '$' byte into subsequent parsing.
Patches
192eac03ce63dCVE-2026-8463 Fix OOB read in argon2_verify
3 files changed · +7 −1
Changes+1 −0 modified@@ -1,6 +1,7 @@ Revision history for Crypt-Argon2 {{$NEXT}} + - CVE-2026-8463 fix OOB read in argon2_verify - Add argon2_implementation 0.030 2025-05-01 15:00:07+02:00 Europe/Brussels
lib/Crypt/Argon2.xs+3 −1 modified@@ -133,7 +133,9 @@ bool argon2d_verify(SV* encoded, SV* password) CODE: encoded_raw = SvPVbyte(encoded, encoded_len); if (ix == 4) { - const char* second_dollar = memchr(encoded_raw + 1, '$', encoded_len - 1); + const char* second_dollar = encoded_len ? memchr(encoded_raw + 1, '$', encoded_len - 1) : NULL; + if (!second_dollar) + Perl_croak(aTHX_ "Could not detect argon2 type: missing '$' separator"); ix = find_argon2_type(encoded_raw + 1, second_dollar - encoded_raw - 1); } password_raw = SvPVbyte(password, password_len);
t/test.t+3 −0 modified@@ -64,4 +64,7 @@ subtest 'needs_rehash', sub { ok argon2_implementation, 'argon2_implementation returns something'; +ok !defined eval { argon2_verify('', 'password') }, 'argon2_verify throws when given an empty string'; +like $@, qr/Could not detect argon2 type: missing '\$' separator/; + done_testing();
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/Leont/crypt-argon2/commit/92eac03ce63d541e0ead7ea5a89b9b67ce0c0e64.patchnvdPatch
- www.openwall.com/lists/oss-security/2026/05/13/4nvdMailing ListThird Party Advisory
- metacpan.org/release/LEONT/Crypt-Argon2-0.031/changesnvdRelease Notes
News mentions
0No linked articles in our index yet.