PT-2026-22392 · Unknown · Http::Session2

Tokuhirom · Publicado 2026-02-27 · Atualizado 2026-03-08 · CVE-2026-3255

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions HTTP::Session2 versions prior to 1.12

Description The software may generate weak session IDs using the rand() function. The session ID generator returns a SHA-1 hash seeded with the rand() function, epoch time, and the process ID (PID). The rand() function is not suitable for cryptographic purposes. If the /dev/urandom device is unavailable, the software reverts to this insecure method.

Recommendations Update to version 1.12 or later.

Correção

Enumeração de Fraquezas

CWE-338

CWE-340

Identificadores relacionados

CVE-2026-3255

Produtos afetados

Http::Session2

Referências · 11

• https://github.com/tokuhirom/HTTP-Session2/commit/9cfde4d7e0965172aef5dcfa3b03bb48df93e636.patch · Correção
• https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.12/changes · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3255 · Nota de Segurança
• http://openwall.com/lists/oss-security/2026/02/27/12 · Nota
• https://twitter.com/oss_security/status/2030571156588089429 · Publicação no Twitter
• https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.01/source/lib/HTTP/Session2/ServerStore.pm#L68 · Nota
• https://t.me/cveNotify/154132 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2027744246938083707 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3255 · Aviso do Fabricante
• https://t.me/cveNotify/154027 · Publicação no Telegram
• https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.11/source/lib/HTTP/Session2/Random.pm#L35 · Nota