PT-2026-22392 · Unknown · Http::Session2

Tokuhirom · Published 2026-02-27 · Updated 2026-03-08 · CVE-2026-3255

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions HTTP::Session2 versions prior to 1.12

Description The software may generate weak session IDs using the rand() function. The session ID generator returns a SHA-1 hash seeded with the rand() function, epoch time, and the process ID (PID). The rand() function is not suitable for cryptographic purposes. If the /dev/urandom device is unavailable, the software reverts to this insecure method.

Recommendations Update to version 1.12 or later.

Fix

Weakness Enumeration

CWE-338

CWE-340

Related Identifiers

CVE-2026-3255

Affected Products

Http::Session2

References · 11

• https://github.com/tokuhirom/HTTP-Session2/commit/9cfde4d7e0965172aef5dcfa3b03bb48df93e636.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-3255 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3255 · Vendor Advisory
• https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.12/changes · Note
• http://openwall.com/lists/oss-security/2026/02/27/12 · Note
• https://twitter.com/oss_security/status/2030571156588089429 · Twitter Post
• https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.01/source/lib/HTTP/Session2/ServerStore.pm#L68 · Note
• https://t.me/cveNotify/154132 · Telegram Post
• https://twitter.com/CVEnew/status/2027744246938083707 · Twitter Post
• https://t.me/cveNotify/154027 · Telegram Post
• https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.11/source/lib/HTTP/Session2/Random.pm#L35 · Note