Loading story…
CVE-2026-5088 affects Apache::API::Password in the Apache2-API Perl distribution through version 0.5.2, where password salt generation can fall back to Perl’s built-in rand function if Crypt::URandom or Bytes::Random::Secure is unavailable. The vulnerable _make_salt and _make_salt_bcrypt methods may therefore produce weak, predictable salt values for password hashing, exposing deployments to reduced password protection and fitting CWE-338, use of a cryptographically weak pseudo-random number generator.
The issue was disclosed by the CPAN Security Group, and maintainer Jacques Deguest said it was fixed in version 0.5.3, which was released to CPAN. Organizations using the module are advised to upgrade to 0.5.3 or later and ensure Crypt::URandom is installed to prevent insecure fallback behavior during salt generation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On April 15, 2026, the CPAN Security Group disclosed that Apache::API::Password through version 0.5.2 could generate weak, predictable password salts when Crypt::URandom or Bytes::Random::Secure were unavailable. The issue was classified as CWE-338, and users were advised to upgrade to version 0.5.3 or later and install Crypt::URandom.
Maintainer Jacques Deguest fixed CVE-2026-5088 in Apache::API::Password version 0.5.3 and released it on CPAN the morning of April 15, 2026. The update removes the insecure fallback to Perl's built-in rand function for generating password salts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability, **CVE-2026-16235**, was disclosed in DRSTEVE's Perl module **`Crypt::Password`**, where versions through **0.28** generate password salts using Perl's built-in **`rand`** function. Because `rand` is predictable and not suitable for cryptographic use, the issue was classified as **CWE-338** and assigned a **CVSS v3.1** score with vector **`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**, indicating potentially severe impact if affected applications rely on the module for password handling. The disclosure said there is **no known exploitation** so far, but exploitation would be **automatable** and could have **total technical impact**. Maintainers and users were advised to avoid the module's default salt generation by supplying salts generated with a stronger source such as **`Crypt::URandom::Token`**, and to consider migrating away from `Crypt::Password` entirely because the package reportedly has not been updated since **2012**.
Jul 20, 2026
Two Perl distributions, **Ado::Sessions** and **Solstice::Session**, were disclosed with vulnerabilities that generate session identifiers from weak, predictable inputs, creating a risk of session prediction and unauthorized access. In **CVE-2026-5083**, Ado::Sessions through version `0.935` uses a SHA-1 hash seeded with Perl `rand`, epoch time, and process ID; in **CVE-2026-5085**, Solstice::Session through version `1440` uses an MD5 digest built from epoch time, a stringified hash reference, Perl `rand()`, and process ID, with the same pattern also affecting `Solstice::Subsession` via `_generateID`. Both flaws were classified under **CWE-340** and **CWE-338**, reflecting predictable values and insufficient entropy in security-sensitive randomness. The disclosures warn that attackers may be able to infer or guess the underlying inputs—particularly time and PID values—and derive valid session tokens to hijack active sessions. The Ado issue is compounded by the project’s abandoned status: the distribution is no longer maintained, has been removed from the CPAN index, and remains available only on BackPAN.
Jun 29, 2026
A high-severity vulnerability, **CVE-2026-13577**, was disclosed in **Dancer2** for Perl that can cause applications to generate predictable session IDs when cryptographically secure random number generator modules are unavailable. The issue affects Dancer2 versions through `2.1.0` and stems from `Dancer2::Core::Role::SessionFactory::generate_id` silently falling back to a session identifier derived from Perl’s built-in `rand()` and other low-entropy values instead of a secure source of randomness. Because Perl’s `rand()` is not suitable for security-sensitive use and may be seeded with only 32 bits, attackers could guess valid session identifiers and gain unauthorized access to user sessions. The flaw is rated **CVSS 8.2** and mapped to **CWE-338** and **CWE-340**. Maintainers recommend upgrading to **Dancer2 2.1.1 or later** and ensuring `Math::Random::ISAAC::XS` or `Crypt::URandom` is installed and available in the application’s `PERL5LIB` path to prevent the insecure fallback.
Jul 20, 2026