« Volver al listado

CVE-2026-3256

Estado: ModificadaCrítica (9.8)—

HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids.

HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.

The distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad remota de generación débil de session IDs en HTTP::Session que permite predecir y falsificar sesiones válidas (AV:N, PR:N). Permite obtener credenciales de sesión o datos sensibles.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementActive Directory ConfigurationUser TrainingPassword PoliciesLimit Access to Resource Over NetworkFilter Network Traffic

Tecnologías afectadas (1)

Ktat — Http\

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-3256",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-3256",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-01T14:14:27.526725Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "repo": "https://github.com/tokuhirom/http-session",
          "vendor": "KTAT",
          "product": "HTTP::Session",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.54",
              "versionType": "custom"
            }
          ],
          "packageName": "http-session",
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "HTTP::Session::ID::SHA1::generate_id"
            },
            {
              "name": "HTTP::Session::ID::MD5::generate_id"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-28T19:16:56.570",
  "references": [
    {
      "url": "https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/MD5.pm",
      "tags": [
        "Product"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/SHA1.pm",
      "tags": [
        "Product"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/TOKUHIROM/http-session-0.54/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/03/28/5",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "description": [
        {
          "lang": "en",
          "value": "CWE-338"
        },
        {
          "lang": "en",
          "value": "CWE-340"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids.\n\nHTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nThe distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead."
    },
    {
      "lang": "es",
      "value": "Las versiones de HTTP::Session hasta la 0.53 para Perl por defecto utilizan identificadores de sesión generados de forma insegura.\n\nHTTP::Session por defecto utiliza HTTP::Session::ID::SHA1 para generar identificadores de sesión usando un hash SHA-1 sembrado con la función rand incorporada, el tiempo de época de alta resolución y el PID. El PID provendrá de un pequeño conjunto de números, y el tiempo de época puede ser adivinado, si no se filtra del encabezado HTTP Date. La función rand incorporada es inadecuada para uso criptográfico.\n\nLa distribución incluye HTTP::session::ID::MD5 que contiene una falla similar, pero utiliza el hash MD5 en su lugar."
    }
  ],
  "lastModified": "2026-06-29T07:16:25.093",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ktat:http\\:\\:session:*:*:*:*:*:perl:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DADAF64A-EA4A-4FB2-9988-17FF1D875219",
              "versionEndIncluding": "0.53"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
}