CVE-2026-3255Disclosure(tokuhirom / http\)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP::Session2 session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand() function is unsuitable for cryptographic usage. HTTP::Session2 after version 1.02 will attempt to use the /dev/urandom device to generate a session id, but if the device is unavailable (for example, under Windows), then it will revert to the insecure method described above.

tokuhirom CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/tokuhirom/HTTP-Session2/commit/9cfde4d7e0965172aef5dcfa3b03bb48df93e636.patch

Vendor / third-party advisories

http://www.openwall.com/lists/oss-security/2026/02/27/12

Other references

Weakness type (CWE)

CWE-338CWE-340

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

http\

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-02-28); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

tokuhirom

Products

http\

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Open Source Security mailing list@oss_security214d
Disclosure
Perl CPAN HTTP::Session2 CVE-2026-3255: Versions before 1.12 may generate weak session ids using the rand() function https://www.openwall.com/lists/oss-security/2026/02/27/12 CVE-2018-25160: Versions through 1.09 do not validate the format of user provided session ids https://www.openwall.com/lists/oss-security/2026/02/27/13
Post summary
The advisory discloses two CVEs in the Perl CPAN HTTP::Session2 module, detailing weak session‑id generation and missing validation, without providing PoC, exploit, or patch information.
01021402
4.4K followersView on X
CVE@CVEnew222d
Disclosure
CVE-2026-3255 HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP::Session2 session id generator returns a SHA-1 … https://www.cve.org/CVERecord?id=CVE-2026-3255
Post summary
CVE‑2026‑3255 exposes a weakness in HTTP::Session2 (pre‑1.12) where session IDs are generated with rand() and SHA‑1, potentially leading to weak session identifiers.
00000150
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	tokuhirom	http\	\	-	-

Explore more

Back to dashboard tokuhirom CVEs http\ vulnerabilities