CVE-2026-3255 HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function

🗓️ 27 Feb 2026 20:12:35Reported by GoogleType

osv🔗 osv.dev👁 6 Views

HTTP::Session2 before 1.12 generates weak session ids with rand, epoch time, and process id, and uses an insecure fallback when urandom is unavailable.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-3255	27 Feb 202620:12	–	attackerkb
Circl	CVE-2026-3255	27 Feb 202623:24	–	circl
CNNVD	HTTP::Session2 安全漏洞	27 Feb 202600:00	–	cnnvd
CVE	CVE-2026-3255	27 Feb 202620:12	–	cve
Cvelist	CVE-2026-3255 HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function	27 Feb 202620:12	–	cvelist
EUVD	EUVD-2026-9063	27 Feb 202621:31	–	euvd
NVD	CVE-2026-3255	27 Feb 202620:21	–	nvd
Positive Technologies	PT-2026-22392	27 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-3255	1 Mar 202601:43	–	redhatcve
Vulnrichment	CVE-2026-3255 HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function	27 Feb 202620:12	–	vulnrichment

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/02/27/12
cpan	www.cpan.org/modules
metacpan	www.metacpan.org/release/TOKUHIROM/HTTP-Session2-1.01/source/lib/HTTP/Session2/ServerStore.pm
metacpan	www.metacpan.org/release/TOKUHIROM/HTTP-Session2-1.11/source/lib/HTTP/Session2/Random.pm
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3255.json
metacpan	www.metacpan.org/release/TOKUHIROM/HTTP-Session2-1.12/changes
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-3255
github	www.github.com/tokuhirom/HTTP-Session2/commit/9cfde4d7e0965172aef5dcfa3b03bb48df93e636.patch
github	www.github.com/tokuhirom/HTTP-Session2

15 Jul 2026 01:49Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.5

EPSS0.00418