CVE-2026-13082: GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.
The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.
The built-in rand function is unsuitable for security applications because it is predictable and reversible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13082?
CVE-2026-13082 has a risk score of 30, indicating a moderate level of severity.
How do I fix CVE-2026-13082?
To fix CVE-2026-13082, upgrade GD::SecurityImage to version 1.76 or later where the issue has been addressed.
What is the impact of CVE-2026-13082?
The impact of CVE-2026-13082 is that it allows attackers to potentially predict CAPTCHA text, making it easier to bypass security measures.
Which versions are affected by CVE-2026-13082?
CVE-2026-13082 affects all versions of GD::SecurityImage through 1.75.
What type of vulnerability is CVE-2026-13082 classified as?
CVE-2026-13082 is classified as a Weak RNG (Random Number Generator) vulnerability.