{"id":"CVE-2025-15638","title":"Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt.\n\nNet::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier","summary":"Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt.\n\nNet::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, whi…","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendor":"atrodo","product":"net::dropbear","affected":["net::dropbear < 0.14"],"patched":["net::dropbear 0.14"],"published":"2026-04-21","updated":"2026-09-30","sourceUpdated":"2026-09-30T22:10:00.273","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-15638","references":[{"url":"https://metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changes","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6129","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12437","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"tags":["nvd"],"epss":0.0057,"epssPercentile":0.45092,"ingestedAt":"2026-09-30T22:27:27.765Z","slug":"CVE-2025-15638","body":"## Overview\n\nNet::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt.\n\nNet::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437.\n\n## Affected\n\n- `net::dropbear < 0.14`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `net::dropbear 0.14`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}