CVE-2026-8463: Heap Out-of-Bounds Read in Crypt::Argon2

An attacker who can control the input to argon2_verify can trigger this vulnerability. By providing an empty encoded string, they can cause memchr to scan adjacent heap memory in search of a '$' separator byte. This could allow an attacker to read sensitive data from the heap, potentially including cryptographic keys, passwords, or other confidential information. While the direct impact is memory disclosure, the consequences could be severe depending on what data resides in the heap at the time of the read. This vulnerability highlights the importance of input validation, especially when dealing with cryptographic functions.

1. Reserved2026-05-13
2. Published2026-05-13

The primary mitigation for CVE-2026-8463 is to upgrade to Crypt::Argon2 version 0.031 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation to prevent argon2_verify from being called with empty encoded input. This could involve checking the length of the encoded string before passing it to the function. Additionally, review application code that utilizes Crypt::Argon2 to identify potential scenarios where empty encoded input might be generated. After upgrading, confirm the fix by attempting to trigger the vulnerability with an empty encoded string and verifying that it no longer results in a crash or memory disclosure.