Executive brief
HTTP::Session is a Perl library used by web applications to manage user sessions. In versions prior to 0.54, the library generates session identifiers using predictable data like the system time and process ID. An attacker could guess these identifiers to hijack user sessions, potentially gaining unauthorized access to sensitive customer data or administrative functions.
Technical details
HTTP::Session (versions through 0.53) defaults to using HTTP::Session::ID::SHA1 (and optionally HTTP::Session::ID::MD5) to generate session identifiers. These modules use a SHA-1 or MD5 hash seeded with the built-in Perl rand() function, the high-resolution epoch time, and the process ID (PID). Because the PID space is small, the epoch time can be guessed or leaked via HTTP headers, and rand() is not cryptographically secure, the resulting session IDs are predictable. A remote attacker can exploit this to perform session fixation or hijacking attacks without authentication. The vulnerability is resolved in version 0.54, which switches to using Crypt::URandom for secure random number generation.
Affected products
- KTAT HTTP::Session < 0.54
Timeline
- 2026-03-28: disclosed: Vulnerability disclosed on oss-security mailing list
- 2026-03-28: advisory: NVD entry published
- 2026-06-27: patched: Version 0.54 released with fix and deprecation notice
References
- https://cpan.org/modules
- https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/MD5.pm
- https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/SHA1.pm
- https://metacpan.org/release/TOKUHIROM/http-session-0.54/changes
- https://security.metacpan.org/docs/guides/random-data-for-security.html
- http://www.openwall.com/lists/oss-security/2026/03/28/5