HTTP::Session vulnerabilities

1 known vulnerability in HTTP::Session from KTAT. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  HTTP::Session: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

  CVE-2026-3256Mar 28, 2026KTAT

  HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch