CVE-2026-3256

HTTP::Session by default uses the HTTP::Session::ID::SHA1 module, which generates session identifiers as an SHA-1 hash powered by Perl's built-in rand() function, the current epoch time with high resolution, and the process number (PID). PID values come from a limited range of numbers, and epoch time can be guessed or read from the HTTP Date header sent by the server. Perl's built-in rand() function is not suitable for cryptographic applications, making the generated identifiers predictable. The HTTP::Session::ID::MD5 module included in the distribution contains an analogous flaw, using only the MD5 hash function instead of SHA-1.

An attacker can guess or brute-force the correct session identifier of another user, hijack their session, and gain full access to their data and web application functions, violating confidentiality, integrity, and availability.

Apply patches available from the vendor according to the references. Until updating, it is recommended to replace the default session identifier generator with an implementation based on a cryptographically secure random source (e.g., according to MetaCPAN Security guidelines: https://security.metacpan.org/docs/guides/random-data-for-security.html) and avoid exposing server time in the HTTP Date header where possible.

HTTP::Session (Perl distribution by KTAT) in versions up to and including 0.53, using the HTTP::Session::ID::SHA1 or HTTP::Session::ID::MD5 modules by default.