Threats affecting pkg:github/Crypt-ScryptKDF

CVE-2026-8647 is a medium severity vulnerability in the Perl module Crypt::ScryptKDF versions through 0.010. The module uses an insecure random number source when no cryptographically secure pseudo-random number generator (CSPRNG) module is available. Specifically, the random_bytes function falls back to the built-in rand() function, which is not cryptographically secure. This weakness can reduce the effectiveness of cryptographic operations relying on this module.