Vulnerability Description
PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely. PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on systems without the device, such as Windows), then it will emit a warning that recommends the user install Crypt::URandom, and then return a string of random bytes generated by the built-in rand function, which is unsuitable for cryptographic applications. This modules does not use the Crypt::URandom module, and installing it will not fix the problem. The random bytes are used for generating an initialisation vector (IV) to encrypt the cookie. A predictable IV may make it easier for malicious users to decrypt and tamper with the session data that is stored in the cookie.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jjnapiork | Pagi\ | <= 0.001003, \ |
Related Weaknesses (CWE)
References
- https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.00Broken Link
- https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.00Release Notes
- http://www.openwall.com/lists/oss-security/2026/03/31/10Mailing ListThird Party Advisory
FAQ
What is CVE-2026-5087?
CVE-2026-5087 is a vulnerability with a CVSS score of 7.5 (HIGH). PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely. PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom de...
How severe is CVE-2026-5087?
CVE-2026-5087 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-5087?
Check the references section above for vendor advisories and patch information. Affected products include: Jjnapiork Pagi\.