CVE-2026-5081Disclosure(chorny / apache\)

LOWCVSS 9.1 · CRITICAL

Signal is active with 4 mentions in latest observed window

Immediate actions

Patch chorny apache\ systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID variable is set by the Apache mod_unique_id plugin, which generates unique ids for the request. The id is based on the IPv4 address, the process id, the epoch time, a 16-bit counter and a thread index, with no obfuscation. The server IP is often available to the public, and if not available, can be guessed from previous session ids being issued. The process ids may also be guessed from previous session ids. The timestamp is easily guessed (and leaked in the HTTP Date response header). The purpose of mod_unique_id is to assign a unique id to requests so that events can be correlated in different logs. The id is not designed, nor is it suitable for security purposes.

chorny CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

http://www.openwall.com/lists/oss-security/2026/05/06/6

Other references

Weakness type (CWE)

CWE-340CWE-341

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

apache\

Threat summary

Patch or workaround signal is available
8 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 6 signals
Disclosure: 6 classified signals
General: 1 classified signal
Peaked 1d ago at 4 mentions (2026-05-06); latest day: 4
8 total mentions across 2 days

Affected systems

Vendors

chorny

Products

apache\

1 version affected across 1 product

Deep dive

Activity timeline8 mentions / 2d

Signal classification3 categories

Disclosure

675.0%

Patch

112.5%

General

112.5%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-06	4	Disclosure3Patch1
2026-05-14	4	Disclosure3General1

Full discourse8 posts

Open Source Security mailing list@oss_security158d
Disclosure
Perl CPAN CVE-2026-5081: Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 session ids are insecure https://www.openwall.com/lists/oss-security/2026/05/06/6 CVE-2026-40562: Gazelle versions through 0.49 allows HTTP Request Smuggling via Improper Header Precedence https://www.openwall.com/lists/oss-security/2026/05/06/7
Post summary
The text announces two Perl CPAN vulnerabilities – CVE‑2026‑5081 affecting session ID security in Apache::Session::Generate::ModUniqueId and CVE‑2026‑40562 enabling HTTP request smuggling in Gazelle – with no PoC, exploit code, or active exploitation reported.
00072505
4.7K followersView on X
Lyrie.ai@lyrie_ai150d
Disclosure
Summary Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. CVE: CVE-2026-5081 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory
Post summary
The advisory discloses that Apache::Session::Generate::ModUniqueId versions 1.54–1.94 have insecure Perl session IDs, classified as CVE‑2026‑5081 with a CVSS score of 9.1 (critical), but no PoC, exploit, or patch information is included.
1000029
210 followersView on X
Lyrie.ai@lyrie_ai150d
Disclosure
CVE: CVE-2026-5081 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure.
Post summary
This advisory announces CVE-2026-5081, a critical flaw in Apache::Session::Generate::ModUniqueId that renders Perl session IDs insecure; no PoC, exploit, or patch details are provided.
1000028
210 followersView on X
Lyrie.ai@lyrie_ai150d
Disclosure
CRITICAL: CVE-2026-5081 (CVSS 9.1) — multiple products. CVE: CVE-2026-5081 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory
Post summary
The text announces a critical vulnerability, CVE‑2026‑5081, with a CVSS score of 9.1 and does not provide details about exploits, PoC, or patches.
1000023
210 followersView on X
Upwind Security MDR@UpwindMDR158d
Patch
🚨 Critical - Apache::Session predictable session IDs (CVE-2026-5081) ModUniqueId uses request metadata (IP, PID, timestamp, counter) to generate session IDs with no randomness, making them predictable and enabling session hijacking. 👉 Affects 1.54–1.94 — avoid ModUniqueId for session generation immediately
Post summary
Apache::Session’s ModUniqueId deterministically creates session IDs, making them predictable and vulnerable to hijacking; users should immediately stop using ModUniqueId for session generation.
0001070
149 followersView on X
CVE@CVEnew158d
Disclosure
CVE-2026-5081 Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54… https://www.cve.org/CVERecord?id=CVE-2026-5081
Post summary
The post announces that Apache::Session::Generate::ModUniqueId versions 1.54 through 1.94 in Perl have insecure session ID generation, but provides no further details, PoC, or patch information.
00010171
57.4K followersView on X
Lyrie.ai@lyrie_ai150d
General
https://lyrie.ai/research/research/cve-2026-5081-advisory #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The message includes only a link and generic hashtags, offering no substantive detail about the CVE.
0000017
210 followersView on X
Infoflowcloud@infoflowcloud158d
Disclosure
🚨*CVE* CVE-2026-5081 Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54… https://www.cve.org/CVERecord?id=CVE-2026-5081 ----- Traducción: CVE-2026-5081 Apa… http://infoflow.cloud`
Post summary
The post simply announces CVE-2026-5081, stating that insecure Perl session IDs exist in Apache::Session::Generate::ModUniqueId versions 1.54–1.94, without providing exploitation details or mitigation steps.
0000037
75 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	chorny	apache\	\	moduniqueid	-

Explore more

Back to dashboard chorny CVEs apache\ vulnerabilities

What researchers are saying

CVE-2026-5081

Lyrie.ai[verified]@lyrie_aiDisclosure

The advisory discloses that Apache::Session::Generate::ModUniqueId versions 1.54–1.94 have insecure Perl session IDs, classified as CVE‑2026‑5081 with a CVSS score of 9.1 (critical), but no PoC, exploit, or patch information is included.

Lyrie.ai[verified]@lyrie_aiDisclosure

This advisory announces CVE-2026-5081, a critical flaw in Apache::Session::Generate::ModUniqueId that renders Perl session IDs insecure; no PoC, exploit, or patch details are provided.

Lyrie.ai[verified]@lyrie_aiDisclosure

The text announces a critical vulnerability, CVE‑2026‑5081, with a CVSS score of 9.1 and does not provide details about exploits, PoC, or patches.

Upwind Security MDR[verified]@UpwindMDRPatch

Apache::Session’s ModUniqueId deterministically creates session IDs, making them predictable and vulnerable to hijacking; users should immediately stop using ModUniqueId for session generation.

Lyrie.ai[verified]@lyrie_aiGeneral

The message includes only a link and generic hashtags, offering no substantive detail about the CVE.

Open Source Security mailing list@oss_securityDisclosure

The text announces two Perl CPAN vulnerabilities – CVE‑2026‑5081 affecting session ID security in Apache::Session::Generate::ModUniqueId and CVE‑2026‑40562 enabling HTTP request smuggling in Gazelle – with no PoC, exploit code, or active exploitation reported.

CVE@CVEnewDisclosure

The post announces that Apache::Session::Generate::ModUniqueId versions 1.54 through 1.94 in Perl have insecure session ID generation, but provides no further details, PoC, or patch information.

Infoflowcloud@infoflowcloudDisclosure

The post simply announces CVE-2026-5081, stating that insecure Perl session IDs exist in Apache::Session::Generate::ModUniqueId versions 1.54–1.94, without providing exploitation details or mitigation steps.