CVE-2026-8503 Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids
Insecure session ID generation using low-entropy sources allows attackers to predict IDs and hijack user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8503?
CVE-2026-8503 is a medium-severity vulnerability in GUIMARD Apache::Session::Generate::SHA256, published on 15 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.
Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.
Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.
This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.
Which versions are affected by CVE-2026-8503?
It affects 1 product.
Products include Guimard Apache\.
How do I fix CVE-2026-8503?
Upgrade to a fixed version.
Is CVE-2026-8503 being exploited?
There is no known exploitation of CVE-2026-8503 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-8503, GHSA-2c59-fqg7-rwrx, UBUNTU-CVE-2026-8503.