CVE-2026-75870 Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "modules": [
      "Punk"
    ],
    "packageName": "Punk",
    "packageURL": "pkg:cpan/Punk",
    "programFiles": [
      "xs/app.xs",
      "include/punk/punk_session.h"
    ],
    "programRoutines": [
      {
        "name": "Punk::App::session"
      },
      {
        "name": "ps_load"
      },
      {
        "name": "ps_writeback"
      }
    ],
    "versions": [
      {
        "lessThan": "0.18",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]