CVE-2026-3256 is a critical weakness in the Perl module HTTP::Session, scored CVSS 9.8. By default it generated session IDs from a hash seeded with Perl's built in rand, a timestamp and the process ID, which an attacker can narrow down. Versions before 0.54 are affected, so upgrade or change the ID generator.
What's affected
The NVD record says HTTP::Session versions before 0.54 are affected. The CPAN Security Group notice posted to oss-security says versions through 0.53, which is the same set. The distribution is published on CPAN under the name http-session.
The default generator is HTTP::Session::ID::SHA1. The distribution also ships HTTP::Session::ID::MD5, which the notice says has a similar flaw.
How to check if you're exposed
Print the installed module version:
perl -MHTTP::Session -e 'print $HTTP::Session::VERSION, "\n"'
Then check how your application builds its session object. If your code names an ID class, note which one. If it does not name one, you are using the default SHA1 generator, which is the weak one.
grep -rn "HTTP::Session" lib/ app.psgi
Applications that already use HTTP::Session::ID::Urandom are on the workaround the advisory recommends.
What to do now
- Upgrade HTTP::Session to 0.54 or later from CPAN.
- After upgrading, confirm which ID generator your code selects. Prefer HTTP::Session::ID::Urandom on systems that have /dev/urandom.
- On systems without /dev/urandom, such as Windows, write a custom ID module built on Crypt::SysRandom or Crypt::URandom, as the notice suggests.
- Invalidate existing sessions after the change so that IDs created by the old generator stop working.
- Review logs for session reuse from unexpected addresses.
Why it matters
The weaknesses are CWE-338, use of a cryptographically weak pseudo random number generator, and CWE-340, generation of predictable numbers or identifiers. A session ID is a bearer secret. If someone can guess it, they can act as the user without a password.
The notice explains the inputs. The process ID comes from a small set of numbers. The timestamp can be guessed, particularly when the server leaks it in an HTTP Date header. Perl's built in rand is not meant for security work. Hashing weak inputs with SHA-1 does not make them strong.
The record's KEV flag is false, and the notice does not report exploitation.
Quick check
Does hashing the ID with SHA-1 make it safe?
No. The hash is only as unpredictable as its inputs, and here the inputs are a weak random call, a guessable time and a process ID.
Sources
Last reviewed: 19 October 2026.
