{"id":"ALPINE-CVE-2026-8463","details":"Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input.\n\nThe auto-detect form of argon2_verify passes encoded_len - 1 as the length argument to memchr without checking that encoded_len is non-zero. When the encoded string is empty, the size_t subtraction underflows to SIZE_MAX and memchr scans adjacent heap memory looking for a '$' separator byte.\n\nA caller that invokes argon2_verify against a stored hash that may legitimately be empty (for example a placeholder row or a NULL column materialised as an empty string) reads out-of-bounds heap memory, which can crash the process or leak the position of an adjacent '$' byte into subsequent parsing.","modified":"2026-11-03T06:32:57.098390780Z","published":"2026-05-13T14:18:17.140Z","upstream":["CVE-2026-8463"],"references":[{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2026-8463"}],"affected":[{"package":{"name":"perl-crypt-argon2","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/perl-crypt-argon2?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.017"},{"fixed":"0.031-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-8463.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}