CVE-2026-8463: Heap Out-of-Bounds Read in Crypt::Argon2

The impact of CVE-2026-8463 is a potential heap out-of-bounds read, which could lead to information disclosure or, in a more complex scenario, arbitrary code execution. An attacker could potentially read sensitive data from memory, including passwords or other cryptographic keys. The vulnerability arises because the argon2_verify function does not properly validate the length of the encoded input before attempting to search for a '$' separator byte using memchr. This can lead to the function reading beyond the allocated memory buffer. The blast radius is limited to applications using the vulnerable version of Crypt::Argon2, but the potential for password compromise makes it a significant concern.

1. Reserviert2026-05-13
2. Veröffentlicht2026-05-13

The recommended mitigation for CVE-2026-8463 is to upgrade Crypt::Argon2 to version 0.031 or later. If upgrading is not immediately possible, avoid using argon2verify with potentially empty encoded input. Implement input validation to ensure that the encoded input is not empty before calling the function. Consider using a different password hashing library if feasible. After upgrade, confirm by testing the argon2verify function with both valid and empty encoded input to ensure that the vulnerability is resolved.