CVE-2026-3256
Predictable Session ID Generation Vulnerability in HTTP::Session Perl Module
Publication date: 2026-03-28
Last updated on: 2026-04-01
Assigner: CPANSec
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ktat | http | to 0.53 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-338 | The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
| CWE-340 | The product uses a scheme that generates numbers or identifiers that are more predictable than required. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in HTTP::Session versions through 0.53 for Perl, where the module generates session IDs using insecure methods.
Specifically, HTTP::Session uses HTTP::Session::ID::SHA1 or HTTP::Session::ID::MD5 to create session identifiers by hashing a combination of the current high-resolution time, a random number generated by Perl's built-in rand function, and the process ID (PID).
The problem is that the built-in rand function is not suitable for cryptographic purposes, and the PID and epoch time can be guessed or inferred, making the session IDs predictable and insecure.
How can this vulnerability impact me? :
Because the session IDs are generated using predictable and insecure methods, an attacker could potentially guess or reproduce valid session IDs.
This could allow an attacker to hijack user sessions, impersonate legitimate users, and gain unauthorized access to sensitive information or functionality within the affected application.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the use of insecurely generated session IDs by HTTP::Session versions through 0.53 for Perl, which use predictable values such as the process ID, epoch time, and the built-in rand function.
To detect this vulnerability on your system, you can check if your Perl environment or web applications are using HTTP::Session versions up to 0.53 and specifically the modules HTTP::Session::ID::SHA1 or HTTP::Session::ID::MD5 for session ID generation.
Commands to help detect the presence of vulnerable modules or versions might include:
- Check installed Perl module version: `perl -MHTTP::Session -e 'print $HTTP::Session::VERSION . "\n";'`
- Search for usage of HTTP::Session::ID::SHA1 or HTTP::Session::ID::MD5 in your codebase: `grep -r "HTTP::Session::ID::SHA1" /path/to/your/app` or `grep -r "HTTP::Session::ID::MD5" /path/to/your/app`
- Inspect session ID patterns in HTTP traffic logs to identify predictable or weak session IDs, for example by capturing HTTP headers with tools like `tcpdump` or `Wireshark` and analyzing session ID values.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Upgrade HTTP::Session to a version later than 0.53 where the session ID generation uses a cryptographically secure random number generator.
- If upgrading is not immediately possible, consider patching or replacing the session ID generation method to use a secure source of randomness instead of the built-in rand function and predictable values like PID and epoch time.
- Review and rotate existing session IDs to invalidate potentially compromised sessions.
- Monitor your systems for suspicious activity that could indicate session hijacking attempts.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in HTTP::Session versions through 0.53 involves the use of insecurely generated session IDs due to reliance on weak randomness sources such as the built-in rand function and predictable values like process ID and epoch time.
This insecure session ID generation can lead to session hijacking or impersonation attacks, which compromises the confidentiality and integrity of user sessions.
Such security weaknesses can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require adequate protection of personal and sensitive data, including secure session management to prevent unauthorized access.