TOKUHIROM HTTP::Session2 up to 1.11 on Perl /dev/urandom rand generation of predictable numbers or identifiers

Summaryinfo

A vulnerability was found in TOKUHIROM HTTP::Session2 up to 1.11 on Perl and classified as problematic. Affected is the function rand of the file /dev/urandom. Executing a manipulation can lead to generation of predictable numbers or identifiers. This vulnerability is handled as CVE-2026-3255. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in TOKUHIROM HTTP::Session2 up to 1.11 on Perl. It has been declared as problematic. This vulnerability affects the function rand of the file /dev/urandom. The manipulation with an unknown input leads to a generation of predictable numbers or identifiers vulnerability. The CWE definition for the vulnerability is CWE-340. The product uses a scheme that generates numbers or identifiers that are more predictable than required. As an impact it is known to affect confidentiality. CVE summarizes:

HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP::Session2 session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand() function is unsuitable for cryptographic usage. HTTP::Session2 after version 1.02 will attempt to use the /dev/urandom device to generate a session id, but if the device is unavailable (for example, under Windows), then it will revert to the insecure method described above.

The advisory is available at metacpan.org. This vulnerability was named CVE-2026-3255 since 02/26/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1600.001 by the MITRE ATT&CK project.

Upgrading to version 1.12 eliminates this vulnerability. Applying the patch 9cfde4d7e0965172aef5dcfa3b03bb48df93e636 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-9063). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• TOKUHIROM

Name

• HTTP::Session2

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion