{"id":"CVE-2026-8503","aliases":["DEBIAN-CVE-2026-8503","EUVD-2026-30536","GHSA-2c59-fqg7-rwrx","UBUNTU-CVE-2026-8503"],"status":"published","title":"Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids","description":"Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.\n\nApache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.\n\nNote that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.\n\nThis issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00243,"percentile":0.15685,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-338","CWE-340"],"published":"2026-05-15T11:06:29Z","modified":"2026-10-28T02:30:27Z","fixes":[{"ecosystem":"Debian:12","package":"libapache-session-browseable-perl","fixed_in":["1.3.11-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libapache-session-browseable-perl","fixed_in":["1.3.16-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libapache-session-browseable-perl","fixed_in":["1.3.19-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libapache-session-browseable-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.11-3+deb12u1"}]}],"versions":["1.3.11-3"]},{"source":"osv","ecosystem":"Debian:13","package":"libapache-session-browseable-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.16-1+deb13u1"}]}],"versions":["1.3.16-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libapache-session-browseable-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.19-1"}]}],"versions":["1.3.16-1","1.3.17-1","1.3.18-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libapache-session-browseable-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-2","1.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache-session-browseable-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-1","1.2.8-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache-session-browseable-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-1","1.3.3-1","1.3.4-1","1.3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libapache-session-browseable-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.9-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libapache-session-browseable-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.11-3","1.3.13-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libapache-session-browseable-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.14-1","1.3.16-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libapache-session-browseable-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.18-1","1.3.19-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libapache-session-browseable-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.16-1","1.3.18-1"]}],"products":[{"vendor":"guimard","product":"apache::session::generate::sha256"},{"vendor":"guimard","product":"apache\\"}],"references":[{"url":"https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/changes","tags":["release-notes","Release Notes","advisory","report"]},{"url":"https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/diff/GUIMARD/Apache-Session-Browseable-1.3.18#lib/Apache/Session/Generate/SHA256.pm","tags":["Product","web","report"]},{"url":"https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/cc915cbbd266776eec3dd8bf4748b15fa827dbd0.patch","tags":["patch","Patch","fix","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40931","tags":["related","Third Party Advisory","web","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40932","tags":["related","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8503","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2c59-fqg7-rwrx"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8503.json","tags":["advisory"]},{"url":"https://github.com/LemonLDAPNG/Apache-Session-Browseable","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-8503","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-8503","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8503","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/40079348/","tags":["report"]},{"url":"https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/cc915cbbd266776eec3dd8bf4748b15fa827dbd0","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-8503","title":"Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids","description":"Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.\n\nApache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.\n\nNote that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.\n\nThis issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.","status":"published","published":"2026-05-15T11:06:29.777Z","modified":"2026-05-15T15:37:28.791Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-340","CWE-338"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-30536","description":"Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.\n\nApache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.\n\nNote that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.\n\nThis issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.","status":"published","published":"2026-05-15T11:06:29Z","modified":"2026-05-15T15:37:28Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:04:28.290329Z"}],"ghsa":[{"id":"GHSA-2c59-fqg7-rwrx","title":"Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.\n...","description":"Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.\n\nApache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.\n\nNote that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.\n\nThis issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.","status":"published","published":"2026-05-15T12:30:31Z","modified":"2026-05-15T18:31:38Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:08:10.185094Z"}],"nvd":[{"id":"CVE-2026-8503","description":"Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.\n\nApache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.\n\nNote that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.\n\nThis issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.","status":"published","published":"2026-05-15T12:17:09.557Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-338","CWE-340"],"updated_at":"2026-11-02T14:12:19.39893Z"}],"osv":[{"id":"CVE-2026-8503","title":"Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids","description":"Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.\n\nApache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.\n\nNote that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.\n\nThis issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.","status":"published","published":"2026-05-15T11:06:29.777Z","modified":"2026-10-28T02:30:27.963668347Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-338","CWE-340"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-8503","description":"Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.  Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.  Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.  This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.","status":"published","published":"2026-05-15T12:17:09.557Z","modified":"2026-10-27T09:47:28.811851709Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"UBUNTU-CVE-2026-8503","description":"Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems. Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module. This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.","status":"published","published":"2026-05-15T12:17:00Z","modified":"2026-10-17T13:01:13.119484992Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"}]}}