Hi,

The following vulnerability was published for libdancer2-perl.

CVE-2026-13577[0]:
| Dancer2 versions through 2.1.0 for Perl generate insecure session
| ids when required CSPRNG modules are unavailable.
| Dancer2::Core::Role::SessionFactory::generate_id silently falls back
| to a built-in rand-derived session id unless both
| Math::Random::ISAAC::XS and Crypt::URandom are available.  The
| fallback session id is generated from a SHA-1 hash of a call to the
| built-in rand function, the absolute path of the
| Dancer2::Core::Role::SessionFactory module, an internal counter, the
| process id, the module instance memory address, and a shuffled
| string of characters (using the List::Util::shuffle function, which
| also uses the built-in rand function).  These are all low-entropy
| and easily guessed sources.  The built-in rand() function is seeded
| with 32-bits and considered unsuitable for security applications.
| Predictable session ids could allow an attacker to gain access to
| systems.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-13577
https://www.cve.org/CVERecord?id=CVE-2026-13577
[1] https://lists.security.metacpan.org/cve-announce/msg/41975698/

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libdancer2-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142718@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libdancer2-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 29 Sep 2026 17:21:21 +0200
Source: libdancer2-perl
Architecture: source
Version: 2.2.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1142718 1148732
Changes:
 libdancer2-perl (2.2.2-1) unstable; urgency=medium
 .
   * Import upstream version 2.2.1.
     Includes fixes for CVE-2026-13577 CVE-2026-93709 CVE-2026-93710
     CVE-2026-93711 CVE-2026-93712.
     Closes: #1142718, #1148732
   * Update Build-Depends-Indep, Depends, and Recommends.
   * Refresh no-phone-home.patch (offset).
 .
   * Import upstream version 2.2.2.
     - Fix cpantesters, Debian build issues in gen.t
   * Drop deprecated or no longer needed lintian overrides.
   * debian/watch: use uscan version 5.
Checksums-Sha1:
 9a3571baf3e9c1e9a91e77ca3270d187b6bf117a 3927 libdancer2-perl_2.2.2-1.dsc
 5cc5bae2780e87936af8f9c42066bd27f74affdc 487609 libdancer2-perl_2.2.2.orig.tar.gz
 1c9b177ef60eb3ac7025d0f10a7752a7e71cc35e 10836 libdancer2-perl_2.2.2-1.debian.tar.xz
 041a76c32dc19191ad5f78cae9ff8c7c053b1821 1015048 libdancer2-perl_2.2.2-1.git.tar.xz
 7f5499b2e1e5efd06ea65cef703343eb963e043b 17756 libdancer2-perl_2.2.2-1_source.buildinfo
Checksums-Sha256:
 db1e19a3f9885f9dd34f83bf77c847d482e78d2cf6c7adb300cb0c036c6f29c1 3927 libdancer2-perl_2.2.2-1.dsc
 f167f2f786b9353676456e0c0a4f3255c2a40f7a048f94ada5aaac1d793d2ba1 487609 libdancer2-perl_2.2.2.orig.tar.gz
 50cfff9ed426997bdee5f0696a94557eaf537a547b4167efdb82461eac83e4b4 10836 libdancer2-perl_2.2.2-1.debian.tar.xz
 827f292914947197419ac7e991749075ff09d9224e585eff5a3eda441389e47f 1015048 libdancer2-perl_2.2.2-1.git.tar.xz
 d90dffd241c582c6651c47c88b59aff4cd77e438bffb613f99a264378b972751 17756 libdancer2-perl_2.2.2-1_source.buildinfo
Files:
 283996861b64beea4564ec8cbb506d4e 3927 perl optional libdancer2-perl_2.2.2-1.dsc
 65c19995c43c85117935bc44a9556de5 487609 perl optional libdancer2-perl_2.2.2.orig.tar.gz
 0c1a86db43a6599fb40f8aa663dabee4 10836 perl optional libdancer2-perl_2.2.2-1.debian.tar.xz
 2024dffe160c104f91ced090d43ee84d 1015048 perl None libdancer2-perl_2.2.2-1.git.tar.xz
 f2b935ddd1b4a7873ad2b7476037a229 17756 perl optional libdancer2-perl_2.2.2-1_source.buildinfo
Git-Tag-Info: tag=f11e1888e6cdcc38b8a48dea7434ffa8633c2b19 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmq72rUACgkQYG0ITkaD
wHkonA//X+hhuNvN93DNC/XEfmZHSeeP0Mel2gJlv5xSeW8BXjG7XD1Bv33DBYcj
HSuulhhjbclnYsYFD1aErtOW41hGpt2Zc0KVRVUn9vC4aRa89p/8+29rBY7cqhml
xuZLFQAgmEB8033CS0shZ37TDa1F8iOLk+Ll7z5NzeOKmLPhIHpn1odfMc06Io8j
BC1r3874lyYI6jD2EFYeZb7ZZTiml2/3rErQflVKTUIwWH5oPfxsN0bzItlbXcff
2x4cZB6jmhnwdGiZdy1nhUKmtBZtv0Z8HAWKafnmjI39l8Ag4M0S/OStBnCnK8gS
ItFFejt1LikV9+yPniOV4HPM6VhlWiI14K8PSfFgwxmRJ2rGvFoUFFroXErMdPQF
4pBF16x2FaoJcJkFlfhu3fs64BrYFr7hVFTsMXfglHL0iKc98eGgNpI9u9WGcs5S
G81dg1MwOy9EkcljqwgIwiOqnUMPDcc38IhCFBo6lgpj2CMcvXXrqNvcv45Yn94Q
apjX70R3QqkZBsKvm4LNl4TDW25DWP8QBZKrOzhcGbt94SKn8/H+99EG+XZEszC/
gAZtYN9re+UXTbXZvJKlAck8lmmkWaaZPhf9H/SCHXfPKqSciULEdUJ33N18BGku
fIlVjqk9vy479IA04jtSUPIPnxnVf8sykH3s0+Rv12oRq8TiF5E=
=RibR
-----END PGP SIGNATURE-----