CVE-2026-13082

Name	CVE-2026-13082
Description	GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string. The built-in rand function is unsuitable for security applications because it is predictable and reversible.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1142330

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libgd-securityimage-perl (PTS)	bullseye	1.75-1	vulnerable
	bookworm	1.75-2	vulnerable
	forky, sid, trixie	1.75-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libgd-securityimage-perl	source	(unstable)	(unfixed)			1142330

https://lists.security.metacpan.org/cve-announce/msg/41903267/
https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch