CVE-2025-15638

CriticalCVSS 10.0/10Last modified Oct 7, 2026

Description

Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt.

Net::Dropbear versions before 0.14 includes versions of Dropbear 2019.78 or earlier. These include versions of libtomcrypt v1.18.1 or earlier, which is affected by CVE-2016-6129 and CVE-2018-12437.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
ATRODO	Net::Dropbear	< 0.14

References

https://metacpan.org/release/ATRODO/Net-Dropbear-0.14/source/dropbear/libtomcrypt/changesRelease Notes
https://www.cve.org/CVERecord?id=CVE-2016-6129Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-12437Third Party Advisory

Timeline

Published: Apr 21, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-15649.8The SetSail Membership plugin for WordPress is vulnerable to in all versions up to, and including, 1.0.3. This is due to the plugin not pro CVE-2025-156416.8Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privile CVE-2025-156426.8Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can l CVE-2025-156437.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b CVE-2025-156454.6Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation CVE-2025-156469.8HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo CVE-2025-156475.5CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are comp CVE-2025-156495.5IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUn CVE-2025-15657.5The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-CVE-2025-156536.8Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability that allows unautho CVE-2025-156547.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague allows Reflected XSS CVE-2025-156557.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL