HTTP::Session versions before 0

HTTP::Session (Ktat's CPAN module) before 0.54 uses HTTP::Session::ID::SHA1 by default, which builds session identifiers by SHA-1-hashing the output of Perl's non-cryptographic rand(), the high-resolution epoch time, and the process ID. None of those inputs are unpredictable to a remote attacker: rand() is a deterministic LCG seeded once at interpreter start, epoch time leaks via the Date: response header, and PIDs live in a tiny space (typically <65k on Linux, <99k on modern kernels). The sibling HTTP::Session::ID::MD5 has the same defect. Affected: all versions before 0.54. Fixed: 0.54 (uses Crypt::URandom / /dev/urandom).

Vendor severity is *wrong*. The 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is auto-generated boilerplate that ignores attacker work factor and victim selection. To exploit this, an attacker has to: identify a *target* session (a specific authenticated user), know roughly when they logged in, know or brute-force the worker PID that minted the ID, and replay enough requests to find the surviving rand() seed. AC:L is indefensible — this is AC:H at best. Real-world impact is *session hijack of a specific user under heavy preconditions*, not unauthenticated RCE.

Why this verdict

• Work factor crushes AC:L. Vendor scored AC:L, but the real chain requires aligning rand() state, PID, and epoch within a few seconds for a *targeted* user — that is textbook AC:H, dropping the score by ~3 points alone.
• Impact is single-session, not system-wide. A successful hijack rides one user's privileges; there is no integrity write outside that user's app context and no availability impact. I:H/A:H in the vendor vector is not defensible.
• Installed base is tiny. HTTP::Session is a niche CPAN module — most Perl web apps use Plack::Session, Catalyst::Plugin::Session, Dancer::Session, or Mojolicious::Sessions. Estimated global installs are low four digits.
• No exploitation pressure. EPSS 0.53%, not KEV, no PoC weaponization, no campaign signal. The bar to even *attempt* this against a real target dwarfs the bar to phish credentials.
• Role multiplier: low-value role (app session store). Even on a high-value app (banking portal, admin console), the chain delivers *one* user's session. The affected component is not in the identity/PKI/hypervisor/backup/CA/kernel-agent catalog — no fleet, domain, or supply-chain pivot is provided by the bug itself.
• Role multiplier: typical role (line-of-business Perl web app). Same — impact terminates at one hijacked session per successful brute-force window. Defense-in-depth (MFA, IP binding, short TTLs) further blunts the outcome.
• Role multiplier: high-value role. N/A — HTTP::Session is not deployed as identity-plane infrastructure. There is no canonical high-value-role deployment of this component, so the deployment-role floor does not lift the verdict above HIGH.

Why not higher?

Not HIGH because exploitation requires sustained, noisy brute-force aligned with a live victim session — detectable by trivial rate-limiting or SIEM auth-failure alerting — and the addressable installed base is small four-digit globally. There is no role-multiplier path: the bug does not live in identity, PKI, hypervisor, backup, or kernel-agent code.

Why not lower?

Not LOW because the defect is real and exploitable in principle: an attacker with a separate PID/timing info-leak and a high-value target sitting behind a misconfigured proxy can succeed, and session hijack of a privileged user (admin, finance, healthcare clinician) is a non-trivial breach event. Upgrade to 0.54 is cheap, so leaving it on the backlog indefinitely is wrong.

1. Force HTTP::Session::ID::Generator to a CSPRNG-backed implementation — Override the default by passing id_generator => HTTP::Session::ID::SHA1->new(rand_bits => sub { Crypt::URandom::urandom(32) }) or swap in a custom generator that reads /dev/urandom directly. This neutralizes the predictable-seed defect without waiting for the package upgrade. No mitigation SLA at MEDIUM — but if a high-value app is affected, ship this within 30 days.
2. Bind sessions to client IP and User-Agent fingerprint — Even with a guessed cookie value, the attacker also has to spoof the originating client fingerprint. Implement in the PSGI middleware layer; rejects mismatched sessions before the handler runs.
3. Cut session TTL and rotate cookie on privilege change — Short TTL (≤30 min idle, ≤8h absolute) shrinks the brute-force window. Rotating session IDs after login and after any role escalation invalidates pre-hijack guessing work.
4. Rate-limit cookie replay on auth-bearing endpoints — Any single source IP submitting hundreds of distinct session cookies per minute is unambiguously hostile — block at the reverse proxy (nginx limit_req, HAProxy stick-tables) or the WAF.
5. Strip the Date: header at the edge and suppress PID leaks — Cuts off two of the three seed inputs an attacker needs. Configure your reverse proxy to overwrite Date: and ensure error pages don't leak $$ or /proc paths.

Run on each Perl application host as the user that owns the app's lib path (or root). Invoke as ./check-cve-2026-3256.sh /path/to/app/lib — the script walks installed HTTP::Session modules and checks their $VERSION. Requires read access to the Perl @INC directories.

#!/usr/bin/env bash
# noisgate verification — CVE-2026-3256 (HTTP::Session < 0.54 weak session IDs)
# Usage: ./check-cve-2026-3256.sh [extra_lib_path ...]
set -u

FIXED_VERSION="0.54"
status="UNKNOWN"
found_any=0

if ! command -v perl >/dev/null 2>&1; then
  echo "UNKNOWN: perl not installed on this host"
  exit 2
fi

# Build -I args for any extra lib paths supplied (e.g. local::lib, Carton, app vendor dirs)
INC_ARGS=()
for p in "$@"; do
  [ -d "$p" ] && INC_ARGS+=("-I$p")
done

result=$(perl "${INC_ARGS[@]}" -e '
  use strict; use warnings;
  my $fixed = "0.54";
  my $worst = "PATCHED";
  eval { require HTTP::Session };
  if ($@) { print "NOT_INSTALLED\n"; exit 0; }
  my $v = $HTTP::Session::VERSION // "unknown";
  print "FOUND HTTP::Session $v\n";
  if ($v eq "unknown") { print "STATUS UNKNOWN\n"; exit 0; }
  # numeric compare on dotted/decimal CPAN versions
  require version;
  my $have = version->parse($v);
  my $need = version->parse($fixed);
  if ($have < $need) { print "STATUS VULNERABLE\n"; }
  else { print "STATUS PATCHED\n"; }
' 2>&1)

echo "$result"

if echo "$result" | grep -q "NOT_INSTALLED"; then
  echo "PATCHED: HTTP::Session is not installed in @INC"
  exit 0
fi
if echo "$result" | grep -q "STATUS VULNERABLE"; then
  echo "VULNERABLE: upgrade HTTP::Session to >= ${FIXED_VERSION} (cpanm HTTP::Session~'>=0.54')"
  exit 1
fi
if echo "$result" | grep -q "STATUS PATCHED"; then
  echo "PATCHED: HTTP::Session is at or above ${FIXED_VERSION}"
  exit 0
fi
echo "UNKNOWN: could not determine HTTP::Session version"
exit 2

Sources

1. oss-security disclosure thread (sibling CVE-2026-3255, same defect class)
2. SentinelOne vulnerability entry — CVE-2026-3256
3. OffSeq threat radar — CVE-2026-3256
4. Tenable CVE record
5. CWE-338 — Use of Cryptographically Weak PRNG
6. HTTP::Session on MetaCPAN
7. Crypt::URandom — the right way to do this on Perl
8. PerlMonks — session id generation guidance