PT-2026-37627 · Cpan · Apache::Session::Generate::Moduniqueid

Robert Rothenberg · Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-5081

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache::Session::Generate::ModUniqueId versions 1.54 through 1.94

Description Apache::Session::Generate::ModUniqueId uses the UNIQUE ID environment variable for session identifiers. This variable is generated by the Apache mod unique id plugin using the IPv4 address, process ID, epoch time, a 16-bit counter, and a thread index without obfuscation. Because the server IP, process IDs, and timestamps are often public or predictable, these session identifiers are insecure and unsuitable for security purposes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-340

Related Identifiers

CVE-2026-5081

Affected Products

Apache::Session::Generate::Moduniqueid

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-5081 · Security Note
• http://openwall.com/lists/oss-security/2026/05/06/6 · Note
• https://httpd.apache.org/docs/current/mod/mod_unique_id.html · Note
• https://twitter.com/oss_security/status/2052050421271720383 · Twitter Post
• https://twitter.com/UpwindMDR/status/2052087646193606835 · Twitter Post
• https://twitter.com/CVEnew/status/2052037443323617409 · Twitter Post
• https://metacpan.org/pod/Apache::Session::Generate::Random · Note