WebDyne-2.075

Security Advisories (1)

CVE-2026-5084 (2026-05-11)

WebDyne::Session versions through 2.075 for Perl generates the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand() function. The rand function is passed a maximum value based on the process id, the epoch time and the reference address of the object, but this information will have no effect on the overall quality of the seed of the message digest. The rand function is seeded by 32-bits and is predictable. It is considered unsuitable for cryptographic purposes. Predictable session ids could allow an attacker to gain access to systems. Note that WebDyne::Session versions 1.042 and earlier appear to be in separate distributions from WebDyne.

Documentation

INSTALL.md

README.md

wdapacheinit

Install or uninstall WebDyne Apache configuration files

wdcompile

parse and display internal data representation of WebDyne files

wddebug

enable or disable debugging in the WebDyne packages

wddump

dump the data structure of a WebDyne page in the cache directory

wdrender

parse and render WebDyne files

Modules

WebDyne

Dynamic Perl web application framework with template compilation and modular design. Designed to be used via Plack/Starman/PSGI or Apache mod_perl web servers, but supports standalone HTML output

WebDyne::Cache

WebDyne module to cache dynamic output for improved performance.

WebDyne::Chain

WebDyne chaining module, allows extension of base WebDyne handler pipeline with additional modules.

WebDyne::Constant

WebDyne module that sets constants and defaults for WebDyne processing

WebDyne::Static

WebDyne module to flag pages as static and compile once to HTML