{"id":"CVE-2026-13577","aliases":["DEBIAN-CVE-2026-13577","EUVD-2026-45896","GHSA-ccc2-34g9-j7rg","MGASA-2026-0437","UBUNTU-CVE-2026-13577"],"status":"published","title":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable","description":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.\n\nDancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available.\n\nThe fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).\n\nThese are all low-entropy and easily guessed sources.\n\nThe built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.\n\nPredictable session ids could allow an attacker to gain access to systems.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0057,"percentile":0.47611,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-338","CWE-340"],"published":"2026-07-20T07:11:10Z","modified":"2026-10-28T02:30:52Z","fixes":[{"ecosystem":"Debian:14","package":"libdancer2-perl","fixed_in":["2.2.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"perl-Dancer2","fixed_in":["2.0.1-1.2.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-Dancer2","fixed_in":["0.400.1-1.2.mga9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libdancer2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.400001+dfsg-1","1.0.0+dfsg-1","1.1.0+dfsg-1","1.1.1+dfsg-1","1.1.2+dfsg-1","2.0.1-1","2.1.0-1","2.2.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libdancer2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2+dfsg-1","2.0.1-1","2.1.0-1","2.2.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libdancer2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-1"}]}],"versions":["1.1.2+dfsg-1","2.0.1-1","2.1.0-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Dancer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1.2.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Dancer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.400.1-1.2.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libdancer2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.160003+dfsg-1","0.163000+dfsg-1","0.166001+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libdancer2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.205000+dfsg-1","0.205002+dfsg-1","0.205002+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libdancer2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.208001+dfsg-1","0.208002+dfsg-1","0.300000+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libdancer2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.300005+dfsg-1","0.301004+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libdancer2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.400001+dfsg-1","1.0.0+dfsg-1","1.1.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libdancer2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2+dfsg-1","2.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libdancer2-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2+dfsg-1"]}],"references":[{"url":"https://metacpan.org/release/CROMEDOME/Dancer2-2.2.0/changes","tags":["release-notes","advisory"]},{"url":"https://github.com/PerlDancer/Dancer2/issues/1807","tags":["issue-tracking","report"]},{"url":"https://github.com/PerlDancer/Dancer2/pull/1804","tags":["issue-tracking","report"]},{"url":"https://github.com/PerlDancer/Dancer2/blob/v2.1.0/lib/Dancer2/Core/Role/SessionFactory.pm#L142","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5080","tags":["related","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13577","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ccc2-34g9-j7rg"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13577.json","tags":["advisory"]},{"url":"https://github.com/PerlDancer/Dancer2","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-13577","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0437.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35967","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/20/5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXWK3ODXBSRKU5P4JUADGHFPAH5I42DO/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-13577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13577","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41975698/","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-13577","title":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable","description":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.\n\nDancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available.\n\nThe fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).\n\nThese are all low-entropy and easily guessed sources.\n\nThe built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.\n\nPredictable session ids could allow an attacker to gain access to systems.","status":"published","published":"2026-07-20T07:11:10.403Z","modified":"2026-09-20T10:17:51.905Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-340","CWE-338"],"updated_at":"2026-11-02T14:19:50.24628Z"}],"euvd":[{"id":"EUVD-2026-45896","description":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.\n\nDancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available.\n\nThe fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).\n\nThese are all low-entropy and easily guessed sources.\n\nThe built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.\n\nPredictable session ids could allow an attacker to gain access to systems.","status":"published","published":"2026-07-20T07:11:10Z","modified":"2026-09-20T10:17:51Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:05.72344Z"}],"ghsa":[{"id":"GHSA-ccc2-34g9-j7rg","title":"Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are...","description":"Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable.\n\nDancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable.\n\nThe fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).\n\nThese are all low-entropy and easily guessed sources.\n\nThe built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.\n\nPredictable session ids could allow an attacker to gain access to systems.","status":"published","published":"2026-07-20T09:31:08Z","modified":"2026-09-20T12:31:29Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:12:14.055197Z"}],"nvd":[{"id":"CVE-2026-13577","description":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.\n\nDancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available.\n\nThe fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).\n\nThese are all low-entropy and easily guessed sources.\n\nThe built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.\n\nPredictable session ids could allow an attacker to gain access to systems.","status":"published","published":"2026-07-20T08:16:28.987Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-338","CWE-340"],"updated_at":"2026-11-02T14:12:31.024898Z"}],"osv":[{"id":"CVE-2026-13577","title":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable","description":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.\n\nDancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available.\n\nThe fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).\n\nThese are all low-entropy and easily guessed sources.\n\nThe built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.\n\nPredictable session ids could allow an attacker to gain access to systems.","status":"published","published":"2026-07-20T07:11:10.403Z","modified":"2026-10-28T02:30:52.942763282Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-338","CWE-340"],"updated_at":"2026-11-02T15:44:57.354194Z"},{"id":"DEBIAN-CVE-2026-13577","description":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.  Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available.  The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).  These are all low-entropy and easily guessed sources.  The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.  Predictable session ids could allow an attacker to gain access to systems.","status":"published","published":"2026-07-20T08:16:28.987Z","modified":"2026-10-25T09:47:31.382494356Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"UBUNTU-CVE-2026-13577","description":"Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.","status":"published","published":"2026-07-20T08:16:00Z","modified":"2026-10-17T12:58:45.460494622Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"MGASA-2026-0437","title":"Updated perl-Dancer2 packages fix a security vulnerability","description":"Dancer2 versions through 2.1.0 for Perl generate insecure session ids\nwhen required CSPRNG modules are unavailable. (CVE-2026-13577)\n","status":"published","published":"2026-09-23T01:45:55Z","modified":"2026-09-23T02:00:06.827915732Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}