========================================================================
CVE-2026-8463                                        CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-8463
  Distribution:  Crypt-Argon2
      Versions:  from 0.017 before 0.031

      MetaCPAN:  https://metacpan.org/dist/Crypt-Argon2
      VCS Repo:  https://github.com/Leont/crypt-argon2

Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap
out-of-bounds read in argon2_verify on empty encoded input

Description
-----------
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap
out-of-bounds read in argon2_verify on empty encoded input.

The auto-detect form of argon2_verify passes encoded_len - 1 as the
length argument to memchr without checking that encoded_len is
non-zero. When the encoded string is empty, the size_t subtraction
underflows to SIZE_MAX and memchr scans adjacent heap memory looking
for a '$' separator byte.

A caller that invokes argon2_verify against a stored hash that may
legitimately be empty (for example a placeholder row or a NULL column
materialised as an empty string) reads out-of-bounds heap memory, which
can crash the process or leak the position of an adjacent '$' byte into
subsequent parsing.

Problem types
-------------
- CWE-126 Buffer Over-read
- CWE-191 Integer Underflow (Wrap or Wraparound)

Solutions
---------
Upgrade to Crypt-Argon2 0.031 or later.

References
----------
https://github.com/Leont/crypt-argon2/commit/92eac03ce63d541e0ead7ea5a89b9b67ce0c0e64.patch
https://metacpan.org/release/LEONT/Crypt-Argon2-0.031/changes

Timeline
--------
- 2026-05-12: Issue reported.
- 2026-05-13: Crypt-Argon2 0.031 released with fix.