CVE-2026-3255

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3255
HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP::Session2 session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand() function is unsuitable for cryptographic usage. HTTP::Session2 after version 1.02 will attempt to use the /dev/urandom device to generate a session id, but if the device is unavailable (for example, under Windows), then it will revert to the insecure method described above.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/tokuhirom/HTTP-Session2/commit/9cfde4d7e0965172aef5dcfa3b03bb48df93e636.patch Patch
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.01/source/lib/HTTP/Session2/ServerStore.pm#L68 Issue Tracking
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.11/source/lib/HTTP/Session2/Random.pm#L35 Issue Tracking
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.12/changes Release Notes
http://www.openwall.com/lists/oss-security/2026/02/27/12 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:tokuhirom:http\:\:session2:*:*:*:*:*:perl:*:*
History

04 Mar 2026, 15:51

Type Values Removed Values Added
References () https://github.com/tokuhirom/HTTP-Session2/commit/9cfde4d7e0965172aef5dcfa3b03bb48df93e636.patch - () https://github.com/tokuhirom/HTTP-Session2/commit/9cfde4d7e0965172aef5dcfa3b03bb48df93e636.patch - Patch
References () https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.01/source/lib/HTTP/Session2/ServerStore.pm#L68 - () https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.01/source/lib/HTTP/Session2/ServerStore.pm#L68 - Issue Tracking
References () https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.11/source/lib/HTTP/Session2/Random.pm#L35 - () https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.11/source/lib/HTTP/Session2/Random.pm#L35 - Issue Tracking
References () https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.12/changes - () https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.12/changes - Release Notes
References () http://www.openwall.com/lists/oss-security/2026/02/27/12 - () http://www.openwall.com/lists/oss-security/2026/02/27/12 - Mailing List, Third Party Advisory
First Time Tokuhirom
Tokuhirom http\
CPE cpe:2.3:a:tokuhirom:http\:\:session2:*:*:*:*:*:perl:*:*

03 Mar 2026, 21:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

02 Mar 2026, 20:30

Type Values Removed Values Added
Summary
  • (es) Las versiones de HTTP::Session2 anteriores a la 1.12 para Perl pueden generar identificadores de sesión débiles utilizando la función rand(). El generador de identificadores de sesión de HTTP::Session2 devuelve un hash SHA-1 inicializado con la función rand incorporada, el tiempo de época y el PID. El PID provendrá de un pequeño conjunto de números, y el tiempo de época puede ser adivinado, si no se filtra del encabezado HTTP Date. La función rand() incorporada no es adecuada para uso criptográfico. HTTP::Session2 después de la versión 1.02 intentará usar el dispositivo /dev/urandom para generar un identificador de sesión, pero si el dispositivo no está disponible (por ejemplo, bajo Windows), entonces revertirá al método inseguro descrito anteriormente.

28 Feb 2026, 01:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/02/27/12 -

27 Feb 2026, 20:21

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-27 20:21

Updated : 2026-03-04 15:51

NVD link : CVE-2026-3255

Mitre link : CVE-2026-3255

CVE.ORG link : CVE-2026-3255

JSON object : View

Products Affected

tokuhirom

  • http\
CWE
CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-340

Generation of Predictable Numbers or Identifiers