Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d0bededb87 advisory.

    Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are     not present. With this update, they are always there.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-28c5da9193 advisory.

    Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are     not present. With this update, they are always there.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d13a2593b1 advisory.

    Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are     not present. With this update, they are always there.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are     unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-     derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback     session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of     the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance     memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also     uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in     rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable     session ids could allow an attacker to gain access to systems. (CVE-2026-13577)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
345824	Fedora 43 : perl-Dancer2 (2026-d0bededb87)	Nessus	Fedora Local Security Checks	Local	high
345760	Fedora 45 : perl-Dancer2 (2026-28c5da9193)	Nessus	Fedora Local Security Checks	Local	high
345750	Fedora 44 : perl-Dancer2 (2026-d13a2593b1)	Nessus	Fedora Local Security Checks	Local	high
328003	Linux Distros Unpatched Vulnerability : CVE-2026-13577	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-13577

high

Tenable Plugins

high

high

high

high