CVE-2026-3256

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3256
HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. The distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/MD5.pm Product
https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/SHA1.pm Product
https://security.metacpan.org/docs/guides/random-data-for-security.html Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/03/28/5 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ktat:http\:\:session:*:*:*:*:*:perl:*:*
History

01 Apr 2026, 15:23

Type Values Removed Values Added
Summary
  • (es) Las versiones de HTTP::Session hasta la 0.53 para Perl por defecto utilizan identificadores de sesión generados de forma insegura. HTTP::Session por defecto utiliza HTTP::Session::ID::SHA1 para generar identificadores de sesión usando un hash SHA-1 sembrado con la función rand incorporada, el tiempo de época de alta resolución y el PID. El PID provendrá de un pequeño conjunto de números, y el tiempo de época puede ser adivinado, si no se filtra del encabezado HTTP Date. La función rand incorporada es inadecuada para uso criptográfico. La distribución incluye HTTP::session::ID::MD5 que contiene una falla similar, pero utiliza el hash MD5 en su lugar.

31 Mar 2026, 20:03

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
First Time Ktat
Ktat http\
References () https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/MD5.pm - () https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/MD5.pm - Product
References () https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/SHA1.pm - () https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/SHA1.pm - Product
References () https://security.metacpan.org/docs/guides/random-data-for-security.html - () https://security.metacpan.org/docs/guides/random-data-for-security.html - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2026/03/28/5 - () http://www.openwall.com/lists/oss-security/2026/03/28/5 - Mailing List, Third Party Advisory
CPE cpe:2.3:a:ktat:http\:\:session:*:*:*:*:*:perl:*:*

28 Mar 2026, 21:17

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/03/28/5 -

28 Mar 2026, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-28 19:16

Updated : 2026-04-01 15:23

NVD link : CVE-2026-3256

Mitre link : CVE-2026-3256

CVE.ORG link : CVE-2026-3256

JSON object : View

Products Affected

ktat

  • http\
CWE
CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-340

Generation of Predictable Numbers or Identifiers