Vulnerability · Published Feb 27, 2026 · Assigned by CPANSec

CVE-2026-3255HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function

Medium 6.5

In plain English

A medium-severity security flaw in HTTP::Session2 from TOKUHIROM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 59.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP::Session2 session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand() function is unsuitable for cryptographic usage. HTTP::Session2 after version 1.02 will attempt to use the /dev/urandom device to generate a session id, but if the device is unavailable (for example, under Windows), then it will revert to the insecure method described above.

Affected products (as reported)

Vendor	Product	Versions
TOKUHIROM	HTTP::Session2	0 – before 1.12

Weakness: CWE-340, CWE-338 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

In plain English

Official description

Affected products (as reported)

References