PT-2026-41294 · Guimard+3 · Apache::Session::Generate::Sha256+3

CVE-2026-8503 · Published 2026-05-15 · Updated 2026-05-20

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache::Session::Generate::SHA256 versions prior to 1.3.19

Description The default session id generator creates insecure session ids by returning a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, which is then hashed again. These sources are predictable and have low entropy, which could allow an attacker to gain unauthorized access to systems.

Recommendations Update to version 1.3.19 or later.

Exploit

Fix

Weakness Enumeration

CWE-340

CWE-338

Related Identifiers

CVE-2026-8503

Affected Products

Apache::Session::Generate::Sha256

Apache::Session::Browseable

Apache

Libapache-Session-Browseable-Perl

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8503.json · Exploit
• https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/cc915cbbd266776eec3dd8bf4748b15fa827dbd0.patch · Patch
• https://cve.org/CVERecord?id=CVE-2025-40931 · Security Note
• https://osv.dev/vulnerability/CVE-2026-8503 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8503 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-40932 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8503 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-8503 · Security Note
• https://ubuntu.com/security/CVE-2026-8503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8503 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-8503 · Vendor Advisory
• https://github.com/LemonLDAPNG/Apache-Session-Browseable · Note
• https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/cc915cbbd266776eec3dd8bf4748b15fa827dbd0 · Note
• https://twitter.com/oss_security/status/2056947346152329657 · Twitter Post
• https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/changes · Note