LEONT Crypt::Argon2 up to 0.030 on Perl argon2_verify length buffer over-read

Summaryinfo

A vulnerability was found in LEONT Crypt::Argon2 up to 0.030 on Perl. It has been declared as problematic. This affects the function argon2_verify. Such manipulation of the argument length leads to buffer over-read. This vulnerability is referenced as CVE-2026-8463. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in LEONT Crypt::Argon2 up to 0.030 on Perl. Affected by this issue is the function argon2_verify. The manipulation of the argument length with an unknown input leads to a buffer over-read vulnerability. Using CWE to declare the problem leads to CWE-126. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. Impacted is confidentiality. CVE summarizes:

Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input. The auto-detect form of argon2_verify passes encoded_len - 1 as the length argument to memchr without checking that encoded_len is non-zero. When the encoded string is empty, the size_t subtraction underflows to SIZE_MAX and memchr scans adjacent heap memory looking for a '$' separator byte. A caller that invokes argon2_verify against a stored hash that may legitimately be empty (for example a placeholder row or a NULL column materialised as an empty string) reads out-of-bounds heap memory, which can crash the process or leak the position of an adjacent '$' byte into subsequent parsing.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-8463 since 05/13/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 314483 (Linux Distros Unpatched Vulnerability : CVE-2026-8463), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.031 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (314483). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• LEONT

Name

• Crypt::Argon2

Version

• 0.030

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion