PT-2026-36091 · Cpan · Dancer::Session::Abstract

Robert Rothenberg · Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-5080

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dancer::Session::Abstract versions prior to 1.3523

Description Session IDs are generated insecurely by summing the character codepoints of the absolute pathname with the process ID, the epoch time, and a value from the built-in rand() function (returning a number between 0 and 999 billion), then concatenating the result three times. The absolute pathname may be guessed or known, the epoch time can be predicted or leaked via HTTP headers, and process IDs often come from a small, sequential set. Additionally, the rand() function is seeded with 32 bits, making it unsuitable for security purposes. This predictability allows an attacker to potentially gain unauthorized system access.

Recommendations Update to a version later than 1.3522.

Fix

Weakness Enumeration

CWE-340

CWE-338

Related Identifiers

CVE-2026-5080

Affected Products

Dancer::Session::Abstract

References · 12

• https://security.metacpan.org/patches/D/Dancer/1.3522/CVE-2026-5080-r1.patch · Patch
• https://cve.org/CVERecord?id=CVE-2026-5080 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5080 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5080 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5080 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5080 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5080 · Vendor Advisory
• https://t.me/CVEtracker/52310 · Telegram Post
• https://metacpan.org/release/BIGPRESH/Dancer-1.3522/source/lib/Dancer/Session/Abstract.pm#L85-102 · Note
• https://twitter.com/oss_security/status/2049941448145924330 · Twitter Post
• https://lists.security.metacpan.org/cve-announce/msg/39488574 · Note
• http://openwall.com/lists/oss-security/2026/04/30/19 · Note