EUVD-2026-40291
GHSA-3x8p-9jc8-598w
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Passive network interception of handshake needed (AC:H, AV:N); no credentials required (PR:N); full RC4 session decryption possible (C:H); no write or disruption capability (I:N, A:N).
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Net::BitTorrent versions through 2.0.1 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG.
The MSE (Message Stream Encryption) handshake derives its 160-bit Diffie-Hellman private key from Perl's rand(), a non-cryptographic drand48-class generator seeded once per process, in KeyExchange.pm. The shared secret and the RC4 keys derived from it (the SHA-1 of "keyA" or "keyB", the shared secret, and the infohash) therefore depend entirely on a predictable PRNG. The same handshake sends, in cleartext, random padding drawn from the same rand() sequence in _random_pad, immediately after the public key and the private-key draw.
A passive observer of the handshake recovers the PRNG state from the cleartext padding, reconstructs the private key, computes the shared secret from the peer's public key on the wire, derives the RC4 keys, and decrypts the connection, defeating the passive-observation obfuscation MSE provides.
AnalysisAI
MSE Diffie-Hellman key exchange in Net::BitTorrent (Perl, all versions through 2.0.1) is rendered cryptographically transparent to passive network observers because Perl's non-cryptographic rand() function generates the 160-bit DH private key in KeyExchange.pm, and the same PRNG sequence simultaneously produces cleartext random padding transmitted during the same handshake. A passive eavesdropper who captures the handshake can recover the drand48 PRNG state from the observable padding bytes, reconstruct the private key, derive the RC4 session keys, and fully decrypt the MSE-encrypted stream - completely defeating the passive-observation obfuscation MSE is designed to provide. No public exploit has been identified at time of analysis, but the recovery is deterministic and requires only standard number theory once the handshake is captured.
Technical ContextAI
Net::BitTorrent is a Perl implementation of the BitTorrent protocol. MSE (Message Stream Encryption, also called BitTorrent protocol encryption) uses a 160-bit Diffie-Hellman key exchange to establish a shared secret, from which RC4 stream cipher keys are derived as the SHA-1 hash of the literal strings 'keyA' or 'keyB', the shared secret, and the torrent infohash. The root cause (CWE-338: Use of Cryptographically Weak PRNG) is that KeyExchange.pm calls Perl's built-in rand(), a drand48-class linear congruential generator with a small internal state, seeded only once per process. Critically, the _random_pad function uses the identical rand() call sequence to produce the cleartext padding bytes sent immediately alongside the DH public key on the wire. Because rand() is a deterministic LCG, an observer who sees the padding bytes can fully reconstruct the generator state and therefore recover the private key that was drawn from the same sequence moments before. The affected CPE is cpe:2.3:a:sanko:net::bittorrent:*:*:*:*:*:*:*:*.
RemediationAI
Consult the vendor GitHub Security Advisory at https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-g444-x2c5-94hc for the patched release version - no exact fixed version number was present in the provided intelligence, so that advisory must be used to confirm the minimum safe version before upgrading. The underlying fix must replace Perl's rand() in KeyExchange.pm with a cryptographically secure random source such as Crypt::URandom, Bytes::Random::Secure, or direct reads from /dev/urandom for all DH private key material and random padding. As an interim compensating control, operators who cannot upgrade immediately should note that MSE provides obfuscation only, not authenticated encryption; disabling MSE entirely and protecting BitTorrent traffic through a VPN or application-layer TLS tunnel eliminates this attack surface without degrading effective confidentiality, since MSE's confidentiality guarantee was already broken. Disabling MSE may affect interoperability with peers that require encrypted connections.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today