Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Solstice::Session versions through 1440 for Perl generates session ids insecurely. The _generateSessionID method returns an MD5 digest seeded by the epoch time, a random hash reference, a call to the built-in rand() function and the process id. The same method is used in the _generateID method in Solstice::Subsession, which is part of the same distribution. The epoch time may be guessed, if it is not leaked in the HTTP Date header. Stringified hash refences will contain predictable content. The built-in rand() function is seeded by 16-bits and is unsuitable for security purposes. The process id comes from a small set of numbers. Predictable session ids could allow an attacker to gain access to systems.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
Perl CPAN CVE-2026-5085: Solstice::Session versions through 1440 generates session ids insecurely https://www.openwall.com/lists/oss-security/2026/04/13/2
Post summary
The advisory announces CVE-2026‑5085, a flaw where Solstice::Session generates insecure session IDs up to version 1440, with no mention of PoC, exploit, or patch.
CVE-2026-5085 Solstice::Session versions through 1440 for Perl generates session ids insecurely. The _generateSessionID method returns an MD5 digest seeded by the epoch time, a rand… https://www.cve.org/CVERecord?id=CVE-2026-5085
Post summary
The CVE details an insecure session ID generation in Solstice::Session, with MD5 seeded by epoch time and randomness, but no notes on patches, PoCs, or exploitation.
CVE-2026-5085 Insecure Session ID Generation in Solstice::Session Perl Versions Through 1440 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5085
Post summary
The post announces CVE‑2026‑5085, highlighting an insecure session ID generation flaw in Solstice::Session Perl versions up to 1440, with a link to detailed vulnerability information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mcrawfor | solstice\ | \ | - | - |