---
id: CVE-2025-15638
title: >-
  Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of
  libtomcrypt.


  Net::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or
  earlier
summary: >-
  Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of
  libtomcrypt.


  Net::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or
  earlier. These include versions of libtomcrypt v1.18.1 or earlier, whi…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
vendor: atrodo
product: 'net::dropbear'
affected:
  - 'net::dropbear < 0.14'
patched:
  - 'net::dropbear 0.14'
published: '2026-04-21'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T22:10:00.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15638'
references:
  - url: >-
      https://metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changes
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://www.cve.org/CVERecord?id=CVE-2016-6129'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://www.cve.org/CVERecord?id=CVE-2018-12437'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
tags:
  - nvd
epss: 0.0057
epssPercentile: 0.45092
ingestedAt: '2026-09-30T22:27:27.765Z'
---

## Overview

Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt.

Net::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437.

## Affected

- `net::dropbear < 0.14`

## Remediation

Upgrade past the affected range:

- `net::dropbear 0.14`