CVE-2026-3256Disclosure(ktat / http\)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch ktat http\ systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. The distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.

ktat CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-338CWE-340

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

http\

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-03-29); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

ktat

Products

http\

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-29	2	Disclosure2
2026-06-29	1	Patch1

Full discourse3 posts

Open Source Security mailing list@oss_security196d
Disclosure
Perl CPAN CVE-2025-15604: Amon2 versions before 6.17 use an insecure random_string implementation for security functions https://www.openwall.com/lists/oss-security/2026/03/28/4 CVE-2026-3256: HTTP::Session versions through 0.53 defaults to using insecurely generated session ids https://www.openwall.com/lists/oss-security/2026/03/28/5
Post summary
The post discloses two CPAN module vulnerabilities—CVE‑2025‑15604 in Amon2, CVE‑2026‑3256 in HTTP::Session—highlighting insecure random/string generation and session ID handling, with no PoC, exploitation, patch, or false‑positive information provided.
00040752
4.4K followersView on X
DFIR Lab@DFIR_Lab104d
Patch
🚨 CRITICAL: CVE-2026-3256 (CVSS 9.8) HTTP::Session for Perl <0.54 uses insecure session ID generation via weak rand() seeding. Attackers can predict session IDs remotely. Patch immediately to v0.54+ #CVE #Vulnerability #PatchNow https://t.co/6Z6e6v88er
Post summary
CVE-2026-3256 is a critical flaw in HTTP::Session that allows remote attackers to predict session IDs; immediate update to version 0.54+ is advised.
0000060
52 followersView on X
CVE@CVEnew196d
Disclosure
CVE-2026-3256 HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate se… https://www.cve.org/CVERecord?id=CVE-2026-3256
Post summary
The notice announces CVE-2026-3256, highlighting that HTTP::Session versions up to 0.53 generate insecure session IDs through a default SHA1-based scheme.
0000083
56.9K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ktat	http\	\	-	-

Explore more

Back to dashboard ktat CVEs http\ vulnerabilities