Weakness in Net::BitTorrent without Cryptographic Security by Perl

CVE-2026-57082

What is CVE-2026-57082?

The Net::BitTorrent library in Perl has a critical cryptographic weakness where it generates the MSE Diffie-Hellman private key using a non-cryptographic pseudo-random number generator (PRNG). This results in the private key being predictable, as it derives from Perl's rand() function, leading to significant security risks. During the MSE handshake, the library sends random padding in cleartext, which allows an observer to recover the PRNG state and reconstruct the private key. Consequently, attackers can easily decrypt the connection and access sensitive data.

References