CVE-2026-5087

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5087", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-03-28T19:29:58.433Z", "datePublished": "2026-03-31T16:03:08.278Z", "dateUpdated": "2026-04-01T14:43:35.295Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "PAGI-Middleware-Session-Store-Cookie", "product": "PAGI::Middleware::Session::Store::Cookie", "programFiles": ["lib/PAGI/Middleware/Session/Store/Cookie.pm"], "programRoutines": [{"name": "PAGI::Middleware::Session::Store::Cookie::_random_bytes"}], "repo": "https://github.com/jjn1056/PAGI-Middleware-Session-Store-Cookie", "vendor": "JJNAPIORK", "versions": [{"lessThanOrEqual": "0.001003", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.\n\nPAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on systems without the device, such as Windows), then it will emit a warning that recommends the user install Crypt::URandom, and then return a string of random bytes generated by the built-in rand function, which is unsuitable for cryptographic applications.\n\nThis modules does not use the Crypt::URandom module, and installing it will not fix the problem.\n\nThe random bytes are used for generating an initialisation vector (IV) to encrypt the cookie.\n\nA predictable IV may make it easier for malicious users to decrypt and tamper with the session data that is stored in the cookie."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1204", "description": "CWE-1204 Generation of Weak Initialization Vector (IV)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-03-31T16:03:08.278Z"}, "references": [{"url": "https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001003/source/lib/PAGI/Middleware/Session/Store/Cookie.pm#L156-173"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001004/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.001004 or newer."}], "source": {"discovery": "UNKNOWN"}, "title": "PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/31/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-31T18:18:48.427Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T14:40:20.356872Z", "id": "CVE-2026-5087", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T14:43:35.295Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5087", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-03-28T19:29:58.433Z", "datePublished": "2026-03-31T16:03:08.278Z", "dateUpdated": "2026-04-01T14:43:35.295Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "PAGI-Middleware-Session-Store-Cookie", "product": "PAGI::Middleware::Session::Store::Cookie", "programFiles": ["lib/PAGI/Middleware/Session/Store/Cookie.pm"], "programRoutines": [{"name": "PAGI::Middleware::Session::Store::Cookie::_random_bytes"}], "repo": "https://github.com/jjn1056/PAGI-Middleware-Session-Store-Cookie", "vendor": "JJNAPIORK", "versions": [{"lessThanOrEqual": "0.001003", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.\n\nPAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on systems without the device, such as Windows), then it will emit a warning that recommends the user install Crypt::URandom, and then return a string of random bytes generated by the built-in rand function, which is unsuitable for cryptographic applications.\n\nThis modules does not use the Crypt::URandom module, and installing it will not fix the problem.\n\nThe random bytes are used for generating an initialisation vector (IV) to encrypt the cookie.\n\nA predictable IV may make it easier for malicious users to decrypt and tamper with the session data that is stored in the cookie."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1204", "description": "CWE-1204 Generation of Weak Initialization Vector (IV)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-03-31T16:03:08.278Z"}, "references": [{"url": "https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001003/source/lib/PAGI/Middleware/Session/Store/Cookie.pm#L156-173"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001004/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.001004 or newer."}], "source": {"discovery": "UNKNOWN"}, "title": "PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/31/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-31T18:18:48.427Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-5087", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T14:40:20.356872Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T14:37:27.052Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "PAGI-Middleware-Session-Store-Cookie", "product": "PAGI::Middleware::Session::Store::Cookie", "programFiles": ["lib/PAGI/Middleware/Session/Store/Cookie.pm"], "programRoutines": [{"name": "PAGI::Middleware::Session::Store::Cookie::_random_bytes"}], "repo": "https://github.com/jjn1056/PAGI-Middleware-Session-Store-Cookie", "vendor": "JJNAPIORK", "versions": [{"lessThanOrEqual": "0.001003", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jjnapiork:pagi\\:\\:middleware\\:\\:session\\:\\:store\\:\\:cookie:*:*:*:*:*:perl:*:*", "matchCriteriaId": "F57280AD-BF5A-4F15-B7E5-F8E2BBA7F47D", "versionEndIncluding": "0.001003", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.\n\nPAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on systems without the device, such as Windows), then it will emit a warning that recommends the user install Crypt::URandom, and then return a string of random bytes generated by the built-in rand function, which is unsuitable for cryptographic applications.\n\nThis modules does not use the Crypt::URandom module, and installing it will not fix the problem.\n\nThe random bytes are used for generating an initialisation vector (IV) to encrypt the cookie.\n\nA predictable IV may make it easier for malicious users to decrypt and tamper with the session data that is stored in the cookie."}, {"lang": "es", "value": "Las versiones de PAGI::Middleware::Session::Store::Cookie hasta la 0.001003 para Perl generan bytes aleatorios de forma insegura.\n\nPAGI::Middleware::Session::Store::Cookie intenta leer bytes directamente del dispositivo /dev/urandom. Si eso falla (por ejemplo, en sistemas sin el dispositivo, como Windows), entonces emitir\u00e1 una advertencia que recomienda al usuario instalar Crypt::URandom, y luego devolver\u00e1 una cadena de bytes aleatorios generados por la funci\u00f3n 'rand' incorporada, lo cual no es adecuado para aplicaciones criptogr\u00e1ficas.\n\nEste m\u00f3dulo no utiliza el m\u00f3dulo Crypt::URandom, e instalarlo no solucionar\u00e1 el problema.\n\nLos bytes aleatorios se utilizan para generar un vector de inicializaci\u00f3n (IV) para cifrar la cookie.\n\nUn IV predecible puede facilitar a los usuarios malintencionados descifrar y manipular los datos de la sesi\u00f3n que se almacenan en la cookie."}], "id": "CVE-2026-5087", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5087", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T14:40:20.356872Z", "version": "2.0.3"}}]}, "published": "2026-03-31T16:16:35.080", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Broken Link"], "url": "https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001003/source/lib/PAGI/Middleware/Session/Store/Cookie.pm#L156-173"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"], "url": "https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001004/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/03/31/10"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-1204"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.001003]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "PAGI::Middleware::Session::Store::Cookie", "source": "cna", "vendor": "JJNAPIORK"}, "product": "pagi::middleware::session::store::cookie", "vendor": "jjnapiork"}], "analysis": {"en": {"generated_at": "2026-04-03T22:37:55.294581+00:00", "value": {"mitigation_remediation": ["Upgrade to version 0.001004 or newer"], "summary": {"action": "Immediate Patch", "impact": "Session data compromise due to predictable IV"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Perl module pagI::Middleware::Session::Store::Cookie distributed by the vendor JJNAPIORK. Versions through 0.001003 are impacted, while the updated release 0.001004 and later contain the fix.", "description_and_impact": "PAGI::Middleware::Session::Store::Cookie versions up to 0.001003 generate random bytes for the encryption IV in an insecure manner by using a fallback built\u2011in random function when reading from /dev/urandom fails. This unreliable source produces a predictable initialization vector, which undermines the confidentiality of the encrypted session cookie. As a result, an attacker who can observe or influence the cookie may be able to decrypt and tamper with session data stored in the cookie, potentially leading to unauthorized access or elevation of privileges within the web application.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity, yet the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA\u2019s KEV catalog, which further reduces the observed threat level. The attack scenario inferred from the description requires an attacker to obtain or influence the encrypted cookie; with a predictable IV, decryption becomes feasible, enabling tampering. While the primary vector is local or remote via web application traffic that transmits the cookie, the defined weakness hinges on the randomness flaw rather than an immediate network exploit. Therefore, the risk is significant enough to warrant prompt action but the probability of rapid exploitation remains low."}}}}, "created": "2026-03-31T19:54:00.561109+00:00", "updated": "2026-04-07T08:07:58.867676+00:00", "vendors": ["jjnapiork", "jjnapiork$PRODUCT$pagi::middleware::session::store::cookie"]}