Medium 6.5Published May 15, 2026

CVE-2026-8503Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids

Updated under an hour ago (Oct 29, 2026, 5:00 AM ET)

Does this affect you?

It affects GUIMARD Apache::Session::Generate::SHA256 and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for GUIMARD Apache::Session::Generate::SHA256

Exploited in the last 30 days

Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems. Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module. This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.

CVSS: 6.5 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE): CWE-340, CWE-338
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: CPANSec
NVD analysis: Analyzed
Record last updated: May 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

GUIMARD Apache::Session::Generate::SHA256 guimard:apache_session_generate_sha256 (from the name)	before 1.3.19	CNA record
guimard apache::session::generate::sha256 guimard:apache::session::generate::sha256	before 1.3.19	NVD

References

References

https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/changes	release-notes
https://metacpan.org/release/GUIMARD/Apache-Session-Browseable-1.3.19/diff/GUIMARD/Apache-Session-Browseable-1.3.18#lib/Apache/Session/Generate/SHA256.pm	product
https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/cc915cbbd266776eec3dd8bf4748b15fa827dbd0.patch	patch
https://www.cve.org/CVERecord?id=CVE-2025-40931	related, third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2025-40932	related, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.