CVE-2026-56016 Details
Description
CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl's rand() is unsuitable for security purposes because it is predictable and reversible. An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.
A vulnerability exists in CGI::Session::ID::md5 versions prior to 4.49 for Perl, where the session IDs are generated from low-entropy sources, making them predictable. The 'generate_id' method creates session IDs by hashing the process ID, the current epoch time, and a random value from Perl's built-in 'rand()' function using MD5. This combination is vulnerable because the process ID is limited to a small range, the epoch time can be easily guessed or extracted from the HTTP Date header, and Perl's 'rand()' is predictable and reversible. As a result, an attacker who can predict a session ID can impersonate the associated session and bypass authentication.
Users are advised to upgrade to CGI::Session::ID::md5 version 4.49 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 1, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/changes | CPANSec | Release NotesVendor |
| https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/source/lib/CGI/Session/ID/md5.pm | CPANSec | Source CodeVendor |
| http://www.openwall.com/lists/oss-security/2026/07/01/6 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
| CWE-340 | Generation of Predictable Numbers or Identifiers | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| CGI::Session::ID::md5 | < 4.49 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CVE |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | CPANSec |