CVE-2026-75870

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75870", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-08-18T11:59:49.642Z", "datePublished": "2026-08-22T13:35:58.346Z", "dateUpdated": "2026-08-25T19:28:36.443Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Punk"], "packageName": "Punk", "packageURL": "pkg:cpan/Punk", "programFiles": ["xs/app.xs", "include/punk/punk_session.h"], "programRoutines": [{"name": "Punk::App::session"}, {"name": "ps_load"}, {"name": "ps_writeback"}], "versions": [{"lessThan": "0.18", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret.\n\nThe session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key.\n\nAn attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1394", "description": "CWE-1394 Use of Default Cryptographic Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-08-22T13:35:58.346Z"}, "references": [{"tags": ["technical-description"], "url": "https://metacpan.org/release/LNATION/Punk-0.17/source/include/punk/punk_session.h"}, {"tags": ["technical-description"], "url": "https://metacpan.org/release/LNATION/Punk-0.17/view/lib/Punk.pm"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/LNATION/Punk-0.18/source/Changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Punk 0.18 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret", "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade to 0.18, declare the session keyword with a non-empty secret. The secret keyword fails closed, so sourcing the key through it turns a missing configuration path or an unset environment variable into a startup error."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/22/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-22T19:07:10.053Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T19:27:34.454527Z", "id": "CVE-2026-75870", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T19:28:36.443Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/22/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-22T19:07:10.053Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-75870", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-25T19:27:34.454527Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T19:28:17.503Z"}}], "cna": {"title": "Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret", "source": {"discovery": "UNKNOWN"}, "affected": [{"modules": ["Punk"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.18", "versionType": "custom"}], "packageURL": "pkg:cpan/Punk", "packageName": "Punk", "programFiles": ["xs/app.xs", "include/punk/punk_session.h"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Punk::App::session"}, {"name": "ps_load"}, {"name": "ps_writeback"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Punk 0.18 or later."}], "references": [{"url": "https://metacpan.org/release/LNATION/Punk-0.17/source/include/punk/punk_session.h", "tags": ["technical-description"]}, {"url": "https://metacpan.org/release/LNATION/Punk-0.17/view/lib/Punk.pm", "tags": ["technical-description"]}, {"url": "https://metacpan.org/release/LNATION/Punk-0.18/source/Changes", "tags": ["release-notes"]}], "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade to 0.18, declare the session keyword with a non-empty secret. The secret keyword fails closed, so sourcing the key through it turns a missing configuration path or an unset environment variable into a startup error."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret.\n\nThe session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key.\n\nAn attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1394", "description": "CWE-1394 Use of Default Cryptographic Key"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-08-22T13:35:58.346Z"}}}, "cveMetadata": {"cveId": "CVE-2026-75870", "state": "PUBLISHED", "dateUpdated": "2026-08-25T19:28:36.443Z", "dateReserved": "2026-08-18T11:59:49.642Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-08-22T13:35:58.346Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Punk"], "packageName": "Punk", "packageURL": "pkg:cpan/Punk", "programFiles": ["xs/app.xs", "include/punk/punk_session.h"], "programRoutines": [{"name": "Punk::App::session"}, {"name": "ps_load"}, {"name": "ps_writeback"}], "versions": [{"lessThan": "0.18", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret.\n\nThe session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key.\n\nAn attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected."}, {"lang": "es", "value": "Versiones de Punk anteriores a la 0.18 para Perl permiten la falsificaci\u00f3n de cookies de sesi\u00f3n a trav\u00e9s de una clave HMAC predeterminada vac\u00eda cuando se declara una sesi\u00f3n sin un secreto.\n\nLa palabra clave session fija sus opciones en la aplicaci\u00f3n tal como se proporcionan: no requiere un secreto, no advierte ni se niega a iniciar cuando uno est\u00e1 ausente. La lectura y la reescritura de la cookie establecen esa clave por defecto a la cadena vac\u00eda, por lo que una declaraci\u00f3n sin opci\u00f3n de secreto, o con una indefinida o vac\u00eda, firma y verifica con una clave HMAC-SHA256 de longitud cero.\n\nUn atacante que conoce el formato de la cookie puede entonces acu\u00f1ar una sin conexi\u00f3n que contenga cualquier contenido que la sesi\u00f3n almacene, como un identificador de usuario o un rol. Nada marca la mala configuraci\u00f3n en tiempo de ejecuci\u00f3n: las cookies est\u00e1n bien formadas y las sesiones completan el ciclo como se espera."}], "id": "CVE-2026-75870", "lastModified": "2026-10-14T13:10:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75870", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T19:27:34.454527Z", "version": "2.0.3"}}]}, "published": "2026-08-22T14:16:33.813", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/LNATION/Punk-0.17/source/include/punk/punk_session.h"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/LNATION/Punk-0.17/view/lib/Punk.pm"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/LNATION/Punk-0.18/source/Changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/08/22/5"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1394"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.18)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "punk", "vendor": "punk"}], "created": "2026-08-22T14:45:03.354852+00:00", "updated": "2026-08-26T03:45:03.837102+00:00", "vendors": ["punk", "punk$PRODUCT$punk"]}