KTAT vulnerabilities

Products

• HTTP::Session 1

Latest KTAT CVEs

Newest publication first

1. CVE-2026-3256 HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids

   Published 2026-03-28

   Critical·CVSS 9.8 EPSS 0.54%

   HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.