CVE-2026-3255 Details
Description
HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP::Session2 session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand() function is unsuitable for cryptographic usage. HTTP::Session2 after version 1.02 will attempt to use the /dev/urandom device to generate a session id, but if the device is unavailable (for example, under Windows), then it will revert to the insecure method described above.
A vulnerability exists in HTTP::Session2 versions prior to 1.12 for Perl, where the session ID generator creates weak session IDs using the rand() function. This method is not suitable for cryptographic purposes, as it can be predicted. The session ID is a SHA-1 hash that is seeded with the rand() output, the current epoch time, and the process ID (PID). The PID is limited to a small range of values, and the epoch time can be estimated unless it is disclosed in the HTTP Date header. Although HTTP::Session2 version 1.02 and later attempts to use /dev/urandom for session ID generation, it defaults back to the insecure rand() method when /dev/urandom is unavailable, such as on Windows.
Users are advised to upgrade to HTTP::Session2 version 1.12 or later, which uses Crypt::SysRandom to generate session IDs securely. Instructions for upgrading can be found on the module's MetaCPAN page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tokuhirom/HTTP-Session2/commit/9cfde4d7e0965172aef5dcfa3b03bb48df93e636.patch | CPANSec | Patch |
| https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.01/source/lib/HTTP/Session2/ServerStore.pm#L68 | CPANSec | Issue Tracking |
| https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.11/source/lib/HTTP/Session2/Random.pm#L35 | CPANSec | Issue Tracking |
| https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.12/changes | CPANSec | Release Notes |
| http://www.openwall.com/lists/oss-security/2026/02/27/12 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
| CWE-340 | Generation of Predictable Numbers or Identifiers | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| tokuhirom http::session2 | < 1.12 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 4, 2026 | Initial Analysis | [email protected] |
| Mar 3, 2026 | CVE Modified | CISA-ADP |
| Feb 28, 2026 | CVE Modified | CVE |
| Feb 27, 2026 | New CVE Received | CPANSec |