CVE-2026-5080 Details
Description
Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely. The session id is generated from summing the character codepoints of the absolute pathname with the process id, the epoch time and calls to the built-in rand() function to return a number between 0 and 999-billion, and concatenating that result three times. The path name might be known or guessed by an attacker, especially for applications known to be written using Dancer with standard installation locations. The epoch time can be guessed by an attacker, and may be leaked in the HTTP header. The process id comes from a small set of numbers, and workers may have sequential process ids. The built-in rand() function is seeded with 32-bits and is considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.
A vulnerability exists in Dancer::Session::Abstract versions through 1.3522 for Perl, where session IDs are generated insecurely. The session ID is created by summing the character code points of the absolute pathname, process ID, epoch time, and calls to the built-in rand() function, which returns a number between 0 and 999 billion. This concatenated result is repeated three times. The pathname could be known or guessed by an attacker, particularly in applications using Dancer with standard installation locations. The epoch time may be estimated and could be leaked in the HTTP header. Process IDs are drawn from a small set of numbers and can be sequential. The rand() function is seeded with 32 bits, making it unsuitable for security purposes. The predictability of session IDs could allow an attacker to gain unauthorized access to systems.
Users can upgrade to Dancer::Session::Abstract versions later than 1.3522, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/BIGPRESH/Dancer-1.3522/source/lib/Dancer/Session/Abstract.pm#L85-102 | CPANSec | Product |
| https://security.metacpan.org/patches/D/Dancer/1.3522/CVE-2026-5080-r1.patch | CPANSec | Patch |
| http://www.openwall.com/lists/oss-security/2026/04/30/19 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
| CWE-340 | Generation of Predictable Numbers or Identifiers | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| perldancer dancer::session::abstract | <= 1.3522 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | Initial Analysis | [email protected] |
| Apr 30, 2026 | CVE Modified | CVE |
| Apr 30, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | New CVE Received | CPANSec |