CVE-2026-8503
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.
Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.
Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.
This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.
Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.
Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.
This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.
- Record
CVE-2026-8503- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-340, CWE-338
- Updated
- 2026-11-02
EUVDEUVD-2026-30536
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.
Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.
Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.
This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.
- Record
EUVD-2026-30536- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2c59-fqg7-rwrx
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. ...
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.
Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.
Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.
This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.
- Record
GHSA-2c59-fqg7-rwrx- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-338
- Updated
- 2026-11-02
NVD
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.
Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.
Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.
This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.
- Record
CVE-2026-8503- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-338, CWE-340
- Updated
- 2026-11-02
OSV
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.
Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.
Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.
This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.
- Record
CVE-2026-8503- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-338, CWE-340
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-8503
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems. Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module. This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.
- Record
DEBIAN-CVE-2026-8503- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-8503
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems. Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module. This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.
- Record
UBUNTU-CVE-2026-8503- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libapache-session-browseable-perlDebian:12 |
before 1.3.11-3+deb12u1, plus listed versions 1.3.11-3 |
1.3.11-3+deb12u1 |
libapache-session-browseable-perlDebian:13 |
before 1.3.16-1+deb13u1, plus listed versions 1.3.16-1 |
1.3.16-1+deb13u1 |
libapache-session-browseable-perlDebian:14 |
before 1.3.19-1, plus listed versions 1.3.16-11.3.17-11.3.18-1 |
1.3.19-1 |
libapache-session-browseable-perlUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.2-21.1-1 |
None known |
libapache-session-browseable-perlUbuntu:18.04:LTS |
All versions, plus listed versions 1.2.2-11.2.8-1 |
None known |
libapache-session-browseable-perlUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.2-11.3.3-11.3.4-11.3.5-1 |
None known |
libapache-session-browseable-perlUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.9-1 |
None known |
libapache-session-browseable-perlUbuntu:24.04:LTS |
All versions, plus listed versions 1.3.11-31.3.13-1 |
None known |
libapache-session-browseable-perlUbuntu:25.10 |
All versions, plus listed versions 1.3.14-11.3.16-1 |
None known |
libapache-session-browseable-perlUbuntu:26.10 |
All versions, plus listed versions 1.3.18-11.3.19-1 |
None known |
libapache-session-browseable-perlUbuntu:26.04:LTS |
All versions, plus listed versions 1.3.16-11.3.18-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-8503 is a medium vulnerability (CVSS 6.5) in Guimard Apache::session::generate::sha256, published May 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in libapache-session-browseable-perl 1.3.11-3+deb12u1.
References
metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/changes
github.com/LemonLDAPNG/Apache-Session-Browseable/commit/cc915cbbd266776eec3dd8bf4748b15fa827dbd0.patch
cve.org/CVERecord?id=CVE-2025-40931
nvd.nist.gov/vuln/detail/CVE-2026-8503
Show 9 moreShow less
cpan.org/modules
security-tracker.debian.org/tracker/CVE-2026-8503
ubuntu.com/security/CVE-2026-8503
lists.security.metacpan.org/cve-announce/msg/40079348