CVE-2026-13082

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets

State: Published
Severity: 5.3 Medium
Published: Jul 17, 2026
Updated: Jul 17, 2026
Reserved: Jun 23, 2026

Description

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.

The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.

The built-in rand function is unsuitable for security applications because it is predictable and reversible.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	CISA-ADP

Weaknesses

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
CWE-804 Guessable CAPTCHA

Affected Products

Product	Versions
GD::SecurityImageBURAK	1.75 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.