CVE-2026-56016: CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources
CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.
The generateid method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl's rand() is unsuitable for security purposes because it is predictable and reversible.
An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CGI::Session::ID::md5to a version that resolves this vulnerability.Fixed in 4.49
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56016?
CVE-2026-56016 has a medium severity rating of 5.9 according to the CVSS 3.1 metrics.
How do I fix CVE-2026-56016?
To mitigate CVE-2026-56016, upgrade to CGI::Session::ID::md5 version 4.49 or later.
What impact does CVE-2026-56016 have on session security?
CVE-2026-56016 can lead to predictable session IDs, increasing the risk of session hijacking.
Which versions are affected by CVE-2026-56016?
CVE-2026-56016 affects all versions of CGI::Session::ID::md5 for Perl before 4.49.
What components are involved in the vulnerability CVE-2026-56016?
CVE-2026-56016 involves CGI::Session::ID::md5, which uses weak low-entropy sources for generating session IDs.