CVE-2026-3256

Critical

Published: 28 March 2026

Published

28 March 2026

Modified

01 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 6.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3256 is a critical-severity PRNG (CWE-338) vulnerability in Ktat Http\. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-23 Session Authenticity good match

prevent

Directly requires protection of session authenticity by generating non-guessable session identifiers resistant to prediction attacks exploiting weak PRNGs.

SI-2 Flaw Remediation good match

prevent

Mandates identification, reporting, and correction of software flaws like insecure session ID generation in HTTP::Session, preventing exploitation.

CM-6 Configuration Settings partial match

prevent

Enforces secure configuration settings to override default insecure session ID generators with cryptographically strong alternatives.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1550.004 Web Session Cookie Lateral Movement

Adversaries can use stolen session cookies to authenticate to web applications and services.

attack.mitre.org →

T1606.001 Web Cookies Credential Access

Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.

attack.mitre.org →

Why these techniques?

Weak PRNG-based session ID generation (rand + time + PID) directly enables remote prediction of valid session tokens without authentication. This facilitates exploitation of the public-facing Perl web application (T1190) and allows use of the resulting tokens as alternate authentication material via web session cookies (T1550.004) or forged web credentials (T1606.001), leading to session hijacking and impersonation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID.…

The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. The distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.

Deeper analysisAI

CVE-2026-3256 affects the Perl module HTTP::Session in versions through 0.53, which defaults to insecure session ID generation. The module uses HTTP::Session::ID::SHA1, seeding a SHA-1 hash with Perl's built-in rand function, high-resolution epoch time, and the process ID (PID). These inputs are predictable: PIDs draw from a small range, epoch time can be guessed or leaked via the HTTP Date header, and rand is unsuitable for cryptography. A similar issue exists in the included HTTP::Session::ID::MD5, which uses MD5 instead of SHA-1. This flaw corresponds to CWE-338 (use of cryptographically weak PRNG) and CWE-340 (generation of predictable numbers or identifiers), earning a CVSS v3.1 base score of 9.8.

Remote attackers require no privileges, authentication, or user interaction to exploit this over the network with low complexity. By predicting session IDs due to the weak entropy sources, adversaries can hijack active sessions, impersonate legitimate users, or perform session fixation attacks, potentially leading to high confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Advisories reference the vulnerable source code in HTTP::Session 0.53 and a Metacpan security guide emphasizing proper random data generation for security-sensitive uses in Perl. The Openwall oss-security mailing list announcement from March 28, 2026, details the issue, recommending avoidance of the default ID generators in favor of cryptographically secure alternatives.