Net::BitTorrent versions before 2.1.0 generate the 160‑bit Diffie‑Hellman private key for the Message Stream Encryption (MSE) handshake by calling Perl's non‑cryptographic rand(). This drand48‑class generator is seeded once per process in KeyExchange.pm, making its output fully predictable. The shared secret and the RC4 keys derived from it (the SHA‑1 of "keyA" or "keyB", the shared secret, and the infohash) therefore depend entirely on this predictable PRNG. The same handshake also sends, in cleartext, random padding drawn from the same rand() sequence in _random_pad, immediately after the public key and private‑key draw. A passive observer of the handshake can recover the PRNG state from this cleartext padding, reconstruct the private key, compute the shared secret from the peer’s public key on the wire, derive the RC4 keys, and decrypt the entire session, thereby defeating MSE’s confidentiality guarantee.

SANKO Net::BitTorrent library for all Perl releases earlier than version 2.1.0. Every installation that loads these affected versions and uses MSE encryption for peer connections is vulnerable. The vulnerability stems from the use of Perl’s rand() for key generation and padding as described.

The CVSS score of 5.9 indicates a medium severity impact. An EPSS score of less than 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only passive observation of the MSE handshake; no privileged access or active manipulation is needed. Once the PRNG state is recovered from the clear‑text padding, the attacker can reconstruct the Diffie‑Hellman private key, compute the shared secret, derive the RC4 keys, and decrypt the session, fully compromising confidentiality.