Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1020 CNY

100%
Buy Us a Coffee

CVE-2026-8721— Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs

AI Predicted 7.5 Difficulty: Easy EPSS 0.01% · P3

Possible ATT&CK Techniques 1AI

T1552.005 · Cloud Instance Metadata API

Affected Version Matrix 1

VendorProductVersion RangeStatus
JONASBNCrypt::OpenSSL::PKCS12≤ 1.94affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-8721

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs
Source: NVD (National Vulnerability Database)
Vulnerability Description
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
不恰当的空终结符
Source: NVD (National Vulnerability Database)
Vulnerability Title
Crypt::OpenSSL::PKCS12 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Crypt::OpenSSL::PKCS12是Dan Sully个人开发者的一个用于 Perl 语言的开源密码学扩展模块，主要提供了对 OpenSSL PKCS12 API 的接口调用能力。 Crypt::OpenSSL::PKCS12 1.94及之前版本存在安全漏洞，该漏洞源于密码参数声明为char*，通过Perl默认typemap路由到SvPV_nolen，丢弃Perl长度，C代码或OpenSSL内部对缓冲区调用strlen，导致第一个NULL之后的所有密码字节被静默丢弃，二进制或KDF派生或HMAC
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
JONASBNCrypt::OpenSSL::PKCS12 0 ~ 1.94 -

II. Public POCs for CVE-2026-8721

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-8721

请登录查看更多情报信息。
Other · 1

IV. Related Vulnerabilities

Same product: Crypt::OpenSSL::PKCS12
Same vendor: JONASBN
Same weakness: CWE-170

V. Comments for CVE-2026-8721

No comments yet

Leave a comment