Loading story…
A high-severity vulnerability, CVE-2026-13577, was disclosed in Dancer2 for Perl that can cause applications to generate predictable session IDs when cryptographically secure random number generator modules are unavailable. The issue affects Dancer2 versions through 2.1.0 and stems from Dancer2::Core::Role::SessionFactory::generate_id silently falling back to a session identifier derived from Perl’s built-in rand() and other low-entropy values instead of a secure source of randomness.
Because Perl’s rand() is not suitable for security-sensitive use and may be seeded with only 32 bits, attackers could guess valid session identifiers and gain unauthorized access to user sessions. The flaw is rated CVSS 8.2 and mapped to CWE-338 and CWE-340. Maintainers recommend upgrading to Dancer2 2.1.1 or later and ensuring Math::Random::ISAAC::XS or Crypt::URandom is installed and available in the application’s PERL5LIB path to prevent the insecure fallback.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A security notice disclosed CVE-2026-13577 affecting Dancer2 for Perl versions through 2.1.0. The flaw allows predictable session IDs when CSPRNG modules are unavailable, causing a fallback to low-entropy rand()-derived values that could enable unauthorized access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceseclists.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two Perl distributions, **Ado::Sessions** and **Solstice::Session**, were disclosed with vulnerabilities that generate session identifiers from weak, predictable inputs, creating a risk of session prediction and unauthorized access. In **CVE-2026-5083**, Ado::Sessions through version `0.935` uses a SHA-1 hash seeded with Perl `rand`, epoch time, and process ID; in **CVE-2026-5085**, Solstice::Session through version `1440` uses an MD5 digest built from epoch time, a stringified hash reference, Perl `rand()`, and process ID, with the same pattern also affecting `Solstice::Subsession` via `_generateID`. Both flaws were classified under **CWE-340** and **CWE-338**, reflecting predictable values and insufficient entropy in security-sensitive randomness. The disclosures warn that attackers may be able to infer or guess the underlying inputs—particularly time and PID values—and derive valid session tokens to hijack active sessions. The Ado issue is compounded by the project’s abandoned status: the distribution is no longer maintained, has been removed from the CPAN index, and remains available only on BackPAN.
Jun 29, 2026
A high-severity vulnerability, **CVE-2026-16235**, was disclosed in DRSTEVE's Perl module **`Crypt::Password`**, where versions through **0.28** generate password salts using Perl's built-in **`rand`** function. Because `rand` is predictable and not suitable for cryptographic use, the issue was classified as **CWE-338** and assigned a **CVSS v3.1** score with vector **`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**, indicating potentially severe impact if affected applications rely on the module for password handling. The disclosure said there is **no known exploitation** so far, but exploitation would be **automatable** and could have **total technical impact**. Maintainers and users were advised to avoid the module's default salt generation by supplying salts generated with a stronger source such as **`Crypt::URandom::Token`**, and to consider migrating away from `Crypt::Password` entirely because the package reportedly has not been updated since **2012**.
Jul 20, 2026
`CVE-2026-5088` affects `Apache::API::Password` in the `Apache2-API` Perl distribution through version `0.5.2`, where password salt generation can fall back to Perl’s built-in `rand` function if `Crypt::URandom` or `Bytes::Random::Secure` is unavailable. The vulnerable `_make_salt` and `_make_salt_bcrypt` methods may therefore produce weak, predictable salt values for password hashing, exposing deployments to reduced password protection and fitting `CWE-338`, use of a cryptographically weak pseudo-random number generator. The issue was disclosed by the CPAN Security Group, and maintainer Jacques Deguest said it was fixed in version `0.5.3`, which was released to CPAN. Organizations using the module are advised to upgrade to `0.5.3` or later and ensure `Crypt::URandom` is installed to prevent insecure fallback behavior during salt generation.
Jun 29, 2026