CVE-2026-13577 CROMEDOME CVE debrief

Who should care

Users of Dancer2 version 2.1.0 or earlier should assess their exposure and consider upgrading to a secure version. System administrators, security teams, and developers using Dancer2 should review their deployments, verify the presence of affected versions, and plan for remediation. Additionally, defenders should implement compensating controls, such as session ID validation and secure session management, to mitigate potential risks.

Technical summary

Dancer2 generates insecure session IDs when CSPRNG modules are unavailable. The fallback session ID is generated from low-entropy sources, including a SHA-1 hash of the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process ID, the module instance memory address, and a shuffled string of characters. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session IDs could allow an attacker to gain access to systems. Users of Dancer2 version 2.1.0 or earlier should assess their exposure and consider upgrading to a secure version.

Defensive priority

High

Recommended defensive actions

• Inventory Dancer2 installations and verify version 2.1.0 or earlier.
• Assess exposure and consider upgrading to a secure version.
• Implement compensating controls, such as session ID validation and secure session management.
• Review system logs and monitoring for suspicious activity.
• Verify the presence of CSPRNG modules and ensure they are properly configured.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and verification are necessary to fully understand the impact and recommended actions. The Dancer2 session factory generates insecure session IDs when CSPRNG modules are unavailable, using low-entropy sources such as the built-in rand function, module paths, and process IDs. Defenders should verify the presence of affected Dancer2 versions, assess exposure, and consider upgrading to a secure version. Additional review of system logs and monitoring for suspicious activity may be necessary.

Official resources