CVE-2026-57082

Name of the Vulnerable Software and Affected Versions Net::BitTorrent versions prior to 2.0.2

Description Net::BitTorrent generates the Message Stream Encryption (MSE) Diffie-Hellman private key using a non-cryptographic Pseudo-Random Number Generator (PRNG). Specifically, the KeyExchange.pm module derives the 160-bit private key from Perl's rand() function, which is a drand48-class generator seeded once per process. Because the shared secret and the resulting RC4 keys depend on this predictable PRNG, a passive observer can recover the PRNG state by analyzing cleartext random padding generated by the random pad function. This allows an attacker to reconstruct the private key, compute the shared secret using the peer's public key, derive the RC4 keys, and decrypt the connection, bypassing the obfuscation provided by MSE.

Recommendations Update Net::BitTorrent to a version newer than 2.0.1.