CVE-2026-13082: GD::SecurityImage Information Disclosure

CVE-2026-13082 Overview

CVE-2026-13082 affects GD::SecurityImage versions through 1.75 for Perl. The module generates CAPTCHA challenge text by sampling characters using Perl's built-in rand function. This function is a pseudo-random number generator unsuitable for security-sensitive contexts because its output is predictable and reversible.

An attacker who observes or infers the internal state of rand can predict subsequent CAPTCHA values. This defeats the CAPTCHA's purpose of distinguishing humans from automated agents. The weakness is classified under [CWE-338] Use of Cryptographically Weak Pseudo-Random Number Generator.

Critical Impact
Attackers can predict or replay CAPTCHA challenge strings generated by GD::SecurityImage, enabling automated abuse of forms and endpoints that rely on the CAPTCHA as a bot-prevention control.

Affected Products

GD::SecurityImage Perl module versions through 1.75
Perl web applications that embed GD::SecurityImage for CAPTCHA generation
Downstream distributions packaging the vulnerable CPAN release

Discovery Timeline

2026-07-17 - CVE-2026-13082 published to the National Vulnerability Database (NVD)
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-13082

Vulnerability Analysis

The random method inside GD::SecurityImage builds the CAPTCHA challenge string by repeatedly selecting characters from an array. The selection index is produced by Perl's built-in rand function, and the method returns a six-character string by default.

Perl's rand is a linear pseudo-random number generator seeded from process state at interpreter startup. Its output stream is deterministic once the seed is known or recovered. Recovering the seed typically requires only a small number of consecutive outputs.

Because the same PRNG state drives every subsequent CAPTCHA in the process, an attacker who solves one challenge can compute the next challenges. The confidentiality of the CAPTCHA text is therefore lost, and the control fails to distinguish humans from scripts.

Root Cause

The root cause is the use of a non-cryptographic PRNG to generate a security-relevant secret. rand was designed for statistical sampling, not for producing unpredictable values. Cryptographically secure alternatives such as Crypt::URandom or /dev/urandom provide unpredictable output suitable for CAPTCHA generation.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker requests one or more CAPTCHA images, solves them, and uses the recovered outputs to reconstruct the internal rand state. Subsequent CAPTCHA values can then be predicted before the images are served, allowing automated submission of forms protected by the CAPTCHA.

No verified public exploit code is available. See the MetaCPAN patch for CVE-2026-13082 for the fix implementation and the related CVE-2025-40916 record for background.

Detection Methods for CVE-2026-13082

Indicators of Compromise

Bursts of successful form submissions from a single client that previously requested many CAPTCHA images in quick succession
Automated traffic patterns where CAPTCHA-protected endpoints see anomalously high success rates
Application logs showing repeated CAPTCHA image generation followed by valid submissions with minimal delay

Detection Strategies

Inventory Perl applications and CPAN dependencies to identify installations of GD::SecurityImage at or below version 1.75
Perform static review of custom code that calls GD::SecurityImage::random or otherwise seeds CAPTCHA text with rand
Correlate CAPTCHA issuance and submission telemetry to identify low-latency, high-volume solve patterns consistent with prediction rather than human input

Monitoring Recommendations

Track per-source-IP ratios of CAPTCHA requests to successful validations and alert on outliers
Log the CAPTCHA generation process identifier and timestamps to detect predictable sequences across requests
Add rate limiting and behavioral analytics to CAPTCHA-protected endpoints to detect scripted abuse independent of CAPTCHA correctness

How to Mitigate CVE-2026-13082

Immediate Actions Required

Upgrade GD::SecurityImage beyond version 1.75 once a fixed release incorporating the patch is available on CPAN
Apply the vendor patch referenced in the MetaCPAN patch for CVE-2026-13082 if updating the package immediately is not possible
Audit application code for any additional uses of Perl's rand in security contexts and replace them with a cryptographically secure source

Patch Information

The upstream patch replaces the insecure rand-based character selection with a cryptographically secure random source. Administrators should install the patched release from CPAN, rebuild any dependent packages, and restart Perl worker processes so that the fix is loaded into memory. Verify the installed module version with perl -MGD::SecurityImage -e 'print $GD::SecurityImage::VERSION' after deployment.

Workarounds

Replace calls to GD::SecurityImage::random with a wrapper that generates challenge text using Crypt::URandom or reads from /dev/urandom
Layer additional bot-prevention controls such as rate limiting, IP reputation, and behavioral analysis in front of CAPTCHA-protected endpoints
Reduce the value of a solved CAPTCHA by shortening its validity window and binding it to a single session and request path

bash

# Verify installed GD::SecurityImage version
perl -MGD::SecurityImage -e 'printf("GD::SecurityImage %s\n", $GD::SecurityImage::VERSION)'

# Apply the upstream patch to an unpacked source tree
cd GD-SecurityImage-1.75
patch -p1 < CVE-2026-13082-r1.patch
perl Makefile.PL && make && make test && sudo make install