Medium 6.5Published Feb 27, 2026

CVE-2026-3255HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function

Updated under an hour ago (Oct 27, 2026, 3:00 AM ET)

Does this affect you?

It affects TOKUHIROM HTTP::Session2 and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for TOKUHIROM HTTP::Session2

Exploited in the last 30 days

HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP::Session2 session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand() function is unsuitable for cryptographic usage. HTTP::Session2 after version 1.02 will attempt to use the /dev/urandom device to generate a session id, but if the device is unavailable (for example, under Windows), then it will revert to the insecure method described above.

CVSS: 6.5 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness (CWE): CWE-340, CWE-338
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: CPANSec
NVD analysis: Analyzed
Record last updated: Mar 3, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

TOKUHIROM HTTP::Session2 tokuhirom:http_session2 (from the name)	before 1.12	CNA record
tokuhirom http::session2 tokuhirom:http::session2	before 1.12	NVD

References

References

https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.11/source/lib/HTTP/Session2/Random.pm#L35	issue-tracking
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.01/source/lib/HTTP/Session2/ServerStore.pm#L68	issue-tracking
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.12/changes	release-notes
https://github.com/tokuhirom/HTTP-Session2/commit/9cfde4d7e0965172aef5dcfa3b03bb48df93e636.patch	patch
http://www.openwall.com/lists/oss-security/2026/02/27/12	mailing-list, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.