========================================================================
CVE-2026-57082                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-57082
   Distribution:  Net-BitTorrent
       Versions:  through 2.0.1

       MetaCPAN:  https://metacpan.org/dist/Net-BitTorrent
       VCS Repo:  https://github.com/sanko/Net-BitTorrent.pm

Net::BitTorrent versions through 2.0.1 for Perl generate the MSE
Diffie-Hellman private key with a non-cryptographic PRNG

Description
-----------
Net::BitTorrent versions through 2.0.1 for Perl generate the MSE
Diffie-Hellman private key with a non-cryptographic PRNG.

The MSE (Message Stream Encryption) handshake derives its 160-bit
Diffie-Hellman private key from Perl's rand(), a non-cryptographic
drand48-class generator seeded once per process, in KeyExchange.pm. The
shared secret and the RC4 keys derived from it (the SHA-1 of "keyA" or
"keyB", the shared secret, and the infohash) therefore depend entirely
on a predictable PRNG. The same handshake sends, in cleartext, random
padding drawn from the same rand() sequence in _random_pad, immediately
after the public key and the private-key draw.

A passive observer of the handshake recovers the PRNG state from the
cleartext padding, reconstructs the private key, computes the shared
secret from the peer's public key on the wire, derives the RC4 keys,
and decrypts the connection, defeating the passive-observation
obfuscation MSE provides.

Problem types
-------------
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
   (PRNG)
- CWE-330 Use of Insufficiently Random Values

Workarounds
-----------
There is no fixed release. Draw the Diffie-Hellman private key and the
handshake padding from a cryptographic source such as Crypt::URandom
rather than rand().

References
----------
https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-g444-x2c5-94hc