{"action":"Upgrade libcrypt-pbkdf2-perl to 0.261630-1~deb13u1~deb12u1 or later.","affected":[{"fixed":"0.261630-1~deb13u1~deb12u1","introduced":"0"}],"component":"libcrypt-pbkdf2-perl","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["0.261630-1~deb13u1~deb12u1"],"id":"tcs_01M5NX1PTVN8JF25AV6777VC93","modified_at":"2026-10-27T09:47:41.023790826Z","published_at":"2026-06-12T16:16:35.047Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-9641","https://security-tracker.debian.org/tracker/CVE-2026-9641"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-9641","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-9641"}],"summary":"Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions"}