{"id":"CVE-2025-15638","aliases":["EUVD-2025-209545","GHSA-fwph-xhj4-v8r5"],"status":"published","title":"Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt","description":"Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt.\n\nNet::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0057,"percentile":0.47627,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1395"],"published":"2026-04-21T15:34:18Z","modified":"2026-10-28T02:31:04Z","products":[{"vendor":"atrodo","product":"net::dropbear"},{"vendor":"atrodo","product":"net\\"}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6129","tags":["vendor-advisory","Third Party Advisory","advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12437","tags":["vendor-advisory","Third Party Advisory","advisory"]},{"url":"https://metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changes","tags":["release-notes","Release Notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15638","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fwph-xhj4-v8r5"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15638.json","tags":["advisory"]},{"url":"https://github.com/atrodo/Net-Dropbear","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-15638","title":"Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt","description":"Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt.\n\nNet::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437.","status":"published","published":"2026-04-21T15:34:18.988Z","modified":"2026-04-21T16:23:17.147Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T14:32:37.680845Z"}],"euvd":[{"id":"EUVD-2025-209545","description":"Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt.\n\nNet::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437.","status":"published","published":"2026-04-21T15:34:18Z","modified":"2026-04-21T16:23:17Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:24:21.512647Z"}],"ghsa":[{"id":"GHSA-fwph-xhj4-v8r5","title":"Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt.\n\nNet:...","description":"Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt.\n\nNet::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437.","status":"published","published":"2026-04-21T18:31:57Z","modified":"2026-04-21T18:32:04Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:07:33.597532Z"}],"nvd":[{"id":"CVE-2025-15638","description":"Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt.\n\nNet::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437.","status":"published","published":"2026-04-21T16:16:19.03Z","modified":"2026-10-07T09:10:00.16Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:02.090779Z"}],"osv":[{"id":"CVE-2025-15638","title":"Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt","description":"Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt.\n\nNet::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437.","status":"published","published":"2026-04-21T15:34:18.988Z","modified":"2026-10-28T02:31:04.591807945Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:44:46.340268Z"}]}}