Skip to main content

Http EUVDEUVD-2026-16939

| CVE-2026-3256 CRITICAL
Generation of Predictable Numbers or Identifiers (CWE-340)
2026-03-28 CPANSec GHSA-mx9c-4xjq-mhj6
Information Disclosure Http
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
EUVD ID Assigned
Mar 28, 2026 - 19:15 euvd
EUVD-2026-16939
Analysis Generated
Mar 28, 2026 - 19:15 vuln.today
CVE Published
Mar 28, 2026 - 18:52 nvd
CRITICAL 9.8

DescriptionNVD

HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids.

HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.

The distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.

AnalysisAI

HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids.

Technical ContextAI

This vulnerability is classified as Generation of Predictable Numbers or Identifiers (CWE-340).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Http

View all
CVE-2020-25574 HIGH POC
7.5 Sep 14

An issue was discovered in the http crate before 0.1.20 for Rust. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2020-35669 MEDIUM POC
6.1 Dec 24

An issue was discovered in the http package through 0.12.2 for Dart. Rated medium severity (CVSS 6.1), this vulnerabilit
CVE-2026-7017 HIGH
7.1 Jul 07

Credential leakage in the Perl HTTP::Tiny client (all versions before 0.095) lets an attacker who controls a redirect de
CVE-2026-7010 MEDIUM
6.5 May 11

HTTP::Tiny versions before 0.093 for Perl fail to validate carriage return and line feed (CRLF) characters in HTTP reque
CVE-2018-25160 MEDIUM
6.5 Feb 27

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code i
CVE-2023-26044 MEDIUM
5.3 May 17

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Rated medium severity (CVSS
CVE-2022-36032 MEDIUM
5.3 Sep 06

ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. Rated medium severity (CVSS 5.3), this

Same weakness CWE-340 – Generation of Predictable Numbers or Identifiers

View all
CVE-2024-47945 CRITICAL POC
9.8
CVE-2025-15604 CRITICAL
9.8
CVE-2026-11374 CRITICAL
9.0
CVE-2026-9733 CRITICAL
9.1
CVE-2026-5081 CRITICAL
9.1
CVE-2026-5085 CRITICAL
9.1
CVE-2026-42932 MEDIUM
6.9
CVE-2026-9219 HIGH
8.3

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

EUVD-2026-16939 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy