CVE-2026-9638 identifies a vulnerability in ARODLAND's Crypt::PBKDF2 Perl module where versions prior to 0.261630 generate salts using the built-in rand function. This function is not cryptographically secure and produces predictable random values, violating best practices for salt generation in password-based key derivation functions. The weakness corresponds to CWE-338, indicating the use of a cryptographically weak pseudo-random number generator. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact.

The use of a predictable pseudo-random number generator for salt generation reduces the entropy and uniqueness of salts. This can enable attackers to perform more effective precomputation or rainbow table attacks against derived keys, potentially compromising the confidentiality of protected data. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 0.261630 or later once available, as this version presumably addresses the issue by using a cryptographically secure random number generator for salt creation. Until then, avoid using affected versions for sensitive cryptographic operations.