{"id":"CVE-2026-3256","aliases":["EUVD-2026-16939","GHSA-mx9c-4xjq-mhj6"],"status":"published","title":"HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids","description":"HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids.\n\nHTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nThe distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0054,"percentile":0.45693,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-338","CWE-340"],"published":"2026-03-28T18:52:39Z","modified":"2026-10-28T02:30:51Z","products":[{"vendor":"ktat","product":"http::session"},{"vendor":"ktat","product":"http\\"}],"references":[{"url":"https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/SHA1.pm","tags":["Product","web"]},{"url":"https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/MD5.pm","tags":["Product","web"]},{"url":"https://security.metacpan.org/docs/guides/random-data-for-security.html","tags":["technical-description","Third Party Advisory","article"]},{"url":"https://metacpan.org/release/TOKUHIROM/http-session-0.54/changes","tags":["release-notes","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/28/5","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3256","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mx9c-4xjq-mhj6"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3256.json","tags":["advisory"]},{"url":"https://github.com/tokuhirom/http-session","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-3256","title":"HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids","description":"HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids.\n\nHTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nThe distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.","status":"published","published":"2026-03-28T18:52:39.917Z","modified":"2026-06-29T06:50:16.274Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-340","CWE-338"],"updated_at":"2026-11-02T13:49:09.229322Z"}],"euvd":[{"id":"EUVD-2026-16939","description":"HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids.\n\nHTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nThe distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.","status":"published","published":"2026-03-28T18:52:39Z","modified":"2026-06-29T06:50:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:23.349194Z"}],"ghsa":[{"id":"GHSA-mx9c-4xjq-mhj6","title":"HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids.\n...","description":"HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids.\n\nHTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nThe distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.","status":"published","published":"2026-03-28T21:33:11Z","modified":"2026-06-29T09:30:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:09:02.633671Z"}],"nvd":[{"id":"CVE-2026-3256","description":"HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids.\n\nHTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nThe distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.","status":"published","published":"2026-03-28T19:16:56.57Z","modified":"2026-06-29T07:16:25.093Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-338","CWE-340"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"CVE-2026-3256","title":"HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids","description":"HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids.\n\nHTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nThe distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.","status":"published","published":"2026-03-28T18:52:39.917Z","modified":"2026-10-28T02:30:51.501900631Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-338","CWE-340"],"updated_at":"2026-11-02T15:45:01.548715Z"}]}}