CVE-2026-5091 describes a timing-side-channel weakness in Catalyst::Plugin::Authentication for Perl. Versions through 0.10024 used Perl's built-in eq comparison when checking authentication data, and timing differences could help an attacker guess the underlying hash or password. The supplied NVD record maps the issue to CWE-208 and cites a GitHub patch plus a MetaCPAN changelog as references.
PAGI::Middleware::Session::Store::Cookie versions up to 0.001003 for Perl insecurely generates random bytes. The module attempts to read from /dev/urandom, and if that fails, it uses the built-in rand function, which is unsuitable for cryptographic applications. This affects the generation of an initialization vector (IV) for encrypting session data stored in cookies, potentially making it easier for atta [truncated]
