CVE-2026-8503 Details
Description
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems. Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module. This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.
A vulnerability exists in Apache::Session::Generate::SHA256 for Perl, in versions prior to 1.3.19, where session IDs are generated insecurely. The default method creates session IDs by hashing a SHA-256 digest of low-entropy, predictable sources such as the built-in rand() function, epoch time, and process ID. This predictability could allow an attacker to guess session IDs and gain unauthorized access. Additionally, versions through 1.3.19 may revert to this insecure method if the Crypt::URandom::urandom function fails, although such a failure is unlikely.
Users can upgrade to Apache::Session::Generate::SHA256 version 1.3.19 or later, where this vulnerability is fixed. Instructions for upgrading can be found on the module's MetaCPAN page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/cc915cbbd266776eec3dd8bf4748b15fa827dbd0.patch | CPANSec | Patch |
| https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/changes | CPANSec | Release Notes |
| https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/diff/GUIMARD/Apache-Session-Browseable-1.3.18#lib/Apache/Session/Generate/SHA256.pm | CPANSec | Product |
| https://www.cve.org/CVERecord?id=CVE-2025-40931 | CPANSec | Third Party Advisory |
| https://www.cve.org/CVERecord?id=CVE-2025-40932 | CPANSec | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
| CWE-340 | Generation of Predictable Numbers or Identifiers | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| guimard apache::session::generate::sha256 | < 1.3.19 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Reanalysis | [email protected] |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 15, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | New CVE Received | CPANSec |