CVE-2026-3255

Katalog CVE

CVSS 6.5 · Medium EPSS 0,49%

Kerentanan Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) pada tokuhirom http. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP::Session2 session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand() function is unsuitable for cryptographic usage. HTTP::Session2 after version 1.02 will attempt to use the /dev/urandom device to generate a session id, but if the device is unavailable (for example, under Windows), then it will revert to the insecure method described above.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-340: Generation of Predictable Numbers or Identifiers

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tokuhirom/HTTP-Session2/commit/9cfde4d7e0965172aef5dcfa3b03bb48df93e636.patch patch
• http://www.openwall.com/lists/oss-security/2026/02/27/12 mailing list · advisory pihak ketiga
• https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.01/source/lib/HTTP/Session2/ServerStore.pm#L68 issue tracking
• https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.11/source/lib/HTTP/Session2/Random.pm#L35 issue tracking
• https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.12/changes release notes