CVE-2026-5081Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure.
Updated under an hour ago ()
Does this affect you?
It affects chorny apache::session::generate::moduniqueid. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID variable is set by the Apache mod_unique_id plugin, which generates unique ids for the request. The id is based on the IPv4 address, the process id, the epoch time, a 16-bit counter and a thread index, with no obfuscation. The server IP is often available to the public, and if not available, can be guessed from previous session ids being issued. The process ids may also be guessed from previous session ids. The timestamp is easily guessed (and leaked in the HTTP Date response header). The purpose of mod_unique_id is to assign a unique id to requests so that events can be correlated in different logs. The id is not designed, nor is it suitable for security purposes.
- CVSS
- 9.1 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- CWE-340, CWE-341
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Modified
- Record last updated
- Jul 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
chorny apache::session::generate::moduniqueid chorny:apache::session::generate::moduniqueid | from 1.54 through 1.94 | NVD |
References
- https://httpd.apache.org/docs/current/mod/mod_unique_id.htmlproduct
- https://metacpan.org/pod/Apache::Session::Generate::Randomproduct
- http://www.openwall.com/lists/oss-security/2026/05/06/6mailing-list, third-party-advisory
- https://access.redhat.com/security/cve/CVE-2026-5081
- https://bugzilla.redhat.com/show_bug.cgi?id=2467174
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5081.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.