PT-2026-41294 · Guimard+2 · Apache::Session::Generate::Sha256+2

Published 2026-05-15 · Updated 2026-05-20 · CVE-2026-8503

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache::Session::Generate::SHA256 versions prior to 1.3.19

Description The default session id generator creates insecure session ids by returning a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, which is then hashed again. These sources are predictable and have low entropy, which could allow an attacker to gain unauthorized access to systems.

Recommendations Update to version 1.3.19 or later.

Fix

Weakness Enumeration

CWE-340

CWE-338

Related Identifiers

CVE-2026-8503

Affected Products

Apache::Session::Generate::Sha256

Apache

Libapache-Session-Browseable-Perl

References · 15

• https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/cc915cbbd266776eec3dd8bf4748b15fa827dbd0.patch · Patch
• https://cve.org/CVERecord?id=CVE-2025-40931 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-8503 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8503 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8503 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-8503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8503 · Security Note
• https://ubuntu.com/security/CVE-2026-8503 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-40932 · Security Note
• https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/cc915cbbd266776eec3dd8bf4748b15fa827dbd0 · Note
• https://t.me/CVEtracker/53914 · Telegram Post
• https://lists.security.metacpan.org/cve-announce/msg/40079348 · Note
• https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/changes · Note
• https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/diff/GUIMARD/Apache-Session-Browseable-1.3.18#lib/Apache/Session/Generate/SHA256.pm · Note
• https://twitter.com/oss_security/status/2056947346152329657 · Twitter Post