https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 12:29:29 +0000 https://cve.radiocsirt.org/vuln/cve-2026-8503 <p><strong>Affected:</strong> GUIMARD Apache::Session::Generate::SHA256</p> <p>Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.</p> <p>Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.</p> <p>Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.</p> <p>This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.</p> <p><strong>Affected:</strong> GUIMARD Apache::Session::Generate::SHA256</p> <p>Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.</p> <p>Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.</p> <p>Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.</p> <p>This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.</p> https://cve.radiocsirt.org/vuln/cve-2026-8503