BIGPRESH Dancer::Session::Abstract up to 1.3522 on Perl rand generation of predictable numbers or identifiers

Summaryinfo

A vulnerability classified as problematic has been found in BIGPRESH Dancer::Session::Abstract up to 1.3522 on Perl. This impacts the function rand. Performing a manipulation results in generation of predictable numbers or identifiers. This vulnerability was named CVE-2026-5080. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in BIGPRESH Dancer::Session::Abstract up to 1.3522 on Perl. It has been classified as problematic. This affects the function rand. The manipulation with an unknown input leads to a generation of predictable numbers or identifiers vulnerability. CWE is classifying the issue as CWE-340. The product uses a scheme that generates numbers or identifiers that are more predictable than required. This is going to have an impact on availability. The summary by CVE is:

Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely. The session id is generated from summing the character codepoints of the absolute pathname with the process id, the epoch time and calls to the built-in rand() function to return a number between 0 and 999-billion, and concatenating that result three times. The path name might be known or guessed by an attacker, especially for applications known to be written using Dancer with standard installation locations. The epoch time can be guessed by an attacker, and may be leaked in the HTTP header. The process id comes from a small set of numbers, and workers may have sequential process ids. The built-in rand() function is seeded with 32-bits and is considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

It is possible to read the advisory at security.metacpan.org. This vulnerability is uniquely identified as CVE-2026-5080 since 03/28/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• BIGPRESH

Name

• Dancer::Session::Abstract

Version

• 1.3522

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion