Secuno
ENNL
Book demo

CVE-2026-8721

9.8 CRITICALEPSS 0.55%
  1. Published17 May 2026

Description

Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-557388.8
A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in…
CVE-2026-50679.8
A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP…
CVE-2026-344648.8
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In…
CVE-2025-677338.5
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and…
CVE-2024-452888.4
A missing null-termination character in the last element of an nvlist array string can…

Frequently asked

Is CVE-2026-8721 being actively exploited?

CVE-2026-8721 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.55%.

How severe is CVE-2026-8721?

CVE-2026-8721 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.55% probability of exploitation.

How do I fix CVE-2026-8721?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-8721 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.