VulnSocial

CVE-2026-5084Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand() function. The rand function is passed a maximum value based on the process id, the epoch time and the reference address of the object, but this information will have no effect on the overall quality of the seed of the message digest. The rand function is seeded by 32-bits and is predictable. It is considered unsuitable for cryptographic purposes. Predictable session ids could allow an attacker to gain access to systems. Note that WebDyne::Session versions 1.042 and earlier appear to be in separate distributions from WebDyne.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-338CWE-340

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-05-11); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-05-11: 2Mentions · 2026-05-15: 1Technical Details · 2026-05-11: 2Technical Details · 2026-05-15: 105-1105-15
Signal classification1 categories
Disclosure
3100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-05-112
Disclosure2
2026-05-151
Disclosure1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    Perl CPAN CVE-2026-8177: XML::LibXML through 2.0210 read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 https://www.openwall.com/lists/oss-security/2026/05/10/8 CVE-2026-5084: WebDyne::Session through 2.075 generates the session id insecurely https://www.openwall.com/lists/oss-security/2026/05/11/3

    Post summary

    The message lists two new CVEs affecting Perl CPAN modules, providing technical details without indicating PoCs, exploits, active use, or mitigations.

    10000102
    4.6K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-5084 WebDyne::Session versions through 2.075 for Perl generates the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call … https://www.cve.org/CVERecord?id=CVE-2026-5084

    Post summary

    The statement discloses that WebDyne::Session versions up to 2.075 create insecure session IDs via MD5 hashing, but does not provide any PoC, exploit, patch, or evidence of active exploitation.

    00000143
    57.5K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-5084 Insecure Session ID Generation in WebDyne::Session Through Version 2.075 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5084

    Post summary

    The text announces the existence of CVE‑2026‑5084 with a brief description of insecure session ID generation but provides no further technical details, PoC, exploit, or mitigation information.

    0000047
    4.0K followersView on X

Explore more

Back to dashboard