CVE-2026-5087

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-5087
PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely. PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on systems without the device, such as Windows), then it will emit a warning that recommends the user install Crypt::URandom, and then return a string of random bytes generated by the built-in rand function, which is unsuitable for cryptographic applications. This modules does not use the Crypt::URandom module, and installing it will not fix the problem. The random bytes are used for generating an initialisation vector (IV) to encrypt the cookie. A predictable IV may make it easier for malicious users to decrypt and tamper with the session data that is stored in the cookie.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001003/source/lib/PAGI/Middleware/Session/Store/Cookie.pm#L156-173 Broken Link
https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001004/changes Release Notes
http://www.openwall.com/lists/oss-security/2026/03/31/10 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:jjnapiork:pagi\:\:middleware\:\:session\:\:store\:\:cookie:*:*:*:*:*:perl:*:*
History

03 Apr 2026, 19:18

Type Values Removed Values Added
CPE cpe:2.3:a:jjnapiork:pagi\:\:middleware\:\:session\:\:store\:\:cookie:*:*:*:*:*:perl:*:*
First Time Jjnapiork
Jjnapiork pagi\
References () https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001003/source/lib/PAGI/Middleware/Session/Store/Cookie.pm#L156-173 - () https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001003/source/lib/PAGI/Middleware/Session/Store/Cookie.pm#L156-173 - Broken Link
References () https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001004/changes - () https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001004/changes - Release Notes
References () http://www.openwall.com/lists/oss-security/2026/03/31/10 - () http://www.openwall.com/lists/oss-security/2026/03/31/10 - Mailing List, Third Party Advisory

01 Apr 2026, 16:23

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

31 Mar 2026, 19:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/03/31/10 -

31 Mar 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-31 16:16

Updated : 2026-04-03 19:18

NVD link : CVE-2026-5087

Mitre link : CVE-2026-5087

CVE.ORG link : CVE-2026-5087

JSON object : View

Products Affected

jjnapiork

  • pagi\
CWE
CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-1204

Generation of Weak Initialization Vector (IV)