CVE-2026-3256 Details
Description
HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. The distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.
A vulnerability exists in HTTP::Session versions through 0.53 for Perl, where the default method of generating session IDs is insecure. The module uses HTTP::Session::ID::SHA1 to create session IDs based on a SHA-1 hash, which is seeded with the built-in rand function, the high-resolution epoch time, and the process ID (PID). This method is flawed because the PID is drawn from a limited range of values, and the epoch time can be predicted unless it is disclosed in the HTTP Date header. Additionally, the rand function is not suitable for cryptographic purposes. While the distribution includes HTTP::Session::ID::MD5, which has a similar vulnerability but employs the MD5 hash, the primary concern lies with the SHA-1 implementation.
Users should update to a version of HTTP::Session that addresses this vulnerability. When generating session IDs, it is recommended to use a secure random number generator, such as Crypt::URandom, Crypt::SysRandom, or a cryptographic-strength PRNG like Crypt::PRNG, to ensure the randomness and unpredictability of the session IDs.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/MD5.pm | CPANSec | Product |
| https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/SHA1.pm | CPANSec | Product |
| https://metacpan.org/release/TOKUHIROM/http-session-0.54/changes | CPANSec | |
| https://security.metacpan.org/docs/guides/random-data-for-security.html | CPANSec | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2026/03/28/5 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
| CWE-340 | Generation of Predictable Numbers or Identifiers | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| ktat http::session | <= 0.53 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Apr 1, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 28, 2026 | CVE Modified | CVE |
| Mar 28, 2026 | New CVE Received | CPANSec |