CVE-2026-56016

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56016", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-06-18T11:27:09.117Z", "datePublished": "2026-07-01T06:46:23.589Z", "dateUpdated": "2026-07-01T17:36:49.480Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "CGI-Session", "product": "CGI::Session::ID::md5", "programFiles": ["lib/CGI/Session/ID/md5.pm"], "programRoutines": [{"name": "CGI::Session::ID::md5::generate_id"}], "repo": "http://github.com/cromedome/cgi-session", "vendor": "MARKSTOS", "versions": [{"lessThan": "4.49", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.\n\nThe generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl's rand() is unsuitable for security purposes because it is predictable and reversible.\n\nAn attacker who predicts a session id can impersonate the corresponding session and bypass authentication."}], "impacts": [{"capecId": "CAPEC-59", "descriptions": [{"lang": "en", "value": "CAPEC-59 Session Credential Falsification through Prediction"}]}, {"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-01T06:46:23.589Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/changes"}, {"tags": ["related"], "url": "https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/source/lib/CGI/Session/ID/md5.pm"}], "solutions": [{"lang": "en", "value": "Upgrade to CGI::Session 4.49 or later, which generates session ids from Crypt::SysRandom."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-06-30T00:00:00.000Z", "value": "Version 4.49 released with fix."}], "title": "CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-01T14:03:10.013809Z", "id": "CVE-2026-56016", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T14:03:16.730Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/01/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-01T17:36:49.480Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/01/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-01T17:36:49.480Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-56016", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T14:03:10.013809Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T14:03:02.936Z"}}], "cna": {"title": "CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-59", "descriptions": [{"lang": "en", "value": "CAPEC-59 Session Credential Falsification through Prediction"}]}, {"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "affected": [{"repo": "http://github.com/cromedome/cgi-session", "vendor": "MARKSTOS", "product": "CGI::Session::ID::md5", "versions": [{"status": "affected", "version": "0", "lessThan": "4.49", "versionType": "custom"}], "packageName": "CGI-Session", "programFiles": ["lib/CGI/Session/ID/md5.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "CGI::Session::ID::md5::generate_id"}]}], "timeline": [{"lang": "en", "time": "2026-06-30T00:00:00.000Z", "value": "Version 4.49 released with fix."}], "solutions": [{"lang": "en", "value": "Upgrade to CGI::Session 4.49 or later, which generates session ids from Crypt::SysRandom."}], "references": [{"url": "https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/changes", "tags": ["release-notes"]}, {"url": "https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/source/lib/CGI/Session/ID/md5.pm", "tags": ["related"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.\n\nThe generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl's rand() is unsuitable for security purposes because it is predictable and reversible.\n\nAn attacker who predicts a session id can impersonate the corresponding session and bypass authentication."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-01T06:46:23.589Z"}}}, "cveMetadata": {"cveId": "CVE-2026-56016", "state": "PUBLISHED", "dateUpdated": "2026-07-01T17:36:49.480Z", "dateReserved": "2026-06-18T11:27:09.117Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-01T06:46:23.589Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "CGI-Session", "product": "CGI::Session::ID::md5", "programFiles": ["lib/CGI/Session/ID/md5.pm"], "programRoutines": [{"name": "CGI::Session::ID::md5::generate_id"}], "repo": "http://github.com/cromedome/cgi-session", "vendor": "MARKSTOS", "versions": [{"lessThan": "4.49", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.\n\nThe generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl's rand() is unsuitable for security purposes because it is predictable and reversible.\n\nAn attacker who predicts a session id can impersonate the corresponding session and bypass authentication."}, {"lang": "es", "value": "Las versiones de CGI::Session::ID::md5 anteriores a la 4.49 para Perl generan identificadores de sesi\u00f3n predecibles a partir de fuentes de baja entrop\u00eda.\n\nEl m\u00e9todo generate_id construye el identificador de sesi\u00f3n a partir de un resumen MD5 del ID del proceso, el tiempo de \u00e9poca y la funci\u00f3n rand() incorporada. Las tres son fuentes predecibles y de baja entrop\u00eda: el PID se extrae de un rango peque\u00f1o, el tiempo de \u00e9poca puede adivinarse o leerse del encabezado HTTP Date, y la funci\u00f3n rand() de Perl no es adecuada para fines de seguridad porque es predecible y reversible.\n\nUn atacante que predice un identificador de sesi\u00f3n puede suplantar la sesi\u00f3n correspondiente y eludir la autenticaci\u00f3n."}], "id": "CVE-2026-56016", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56016", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-01T14:03:10.013809Z", "version": "2.0.3"}}]}, "published": "2026-07-01T08:16:21.883", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/source/lib/CGI/Session/ID/md5.pm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/07/01/6"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-340"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-CGI-Session: perl-CGI-Session: Authentication bypass via predictable session IDs", "id": "2495858", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495858"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-331", "details": ["A flaw was found in perl-CGI-Session. This vulnerability allows a remote attacker to predict session identifiers due to the use of low-entropy sources in the `generate_id` method. By predicting a session identifier, an attacker can impersonate a user's session, leading to a bypass of authentication mechanisms and potential unauthorized access to sensitive information or functionality."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-56016", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "perl-CGI-Session", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "perl-CGI-Session", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2026-07-01T06:46:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-56016\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56016\nhttps://metacpan.org/release/MARKSTOS/CGI-Session-4.49/changes\nhttps://metacpan.org/release/MARKSTOS/CGI-Session-4.49/source/lib/CGI/Session/ID/md5.pm"], "statement": "This Important flaw in perl-CGI-Session allows a remote attacker to bypass authentication by predicting session identifiers. The `CGI::Session::ID::md5` module generates session IDs using low-entropy sources, including process ID, epoch time, and a predictable random number generator. This predictability enables an attacker to impersonate a user's session, potentially leading to unauthorized access in web applications utilizing this module for session management.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.49)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "CGI::Session::ID::md5", "source": "cna", "vendor": "MARKSTOS"}, "product": "cgi::session::id::md5", "vendor": "markstos"}], "created": "2026-07-01T15:15:04.129466+00:00", "updated": "2026-08-02T00:00:14.755590+00:00", "vendors": ["markstos", "markstos$PRODUCT$cgi::session::id::md5"]}