CVE-2026-5081

{"id": "CVE-2026-5081", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5081", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T14:07:35.398679Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "http://github.com/chorny/Apache-Session", "vendor": "CHORNY", "product": "Apache::Session::Generate::ModUniqueId", "versions": [{"status": "affected", "version": "1.54", "versionType": "custom", "lessThanOrEqual": "1.94"}], "packageName": "Apache-Session", "programFiles": ["lib/Session/Generate/ModUniqueId.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Apache::Session::Generate::ModUniqueId::generate_id"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "packageName": "perl", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-05-06T13:16:09.833", "references": [{"url": "https://httpd.apache.org/docs/current/mod/mod_unique_id.html", "tags": ["Product"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/pod/Apache::Session::Generate::Random", "tags": ["Product"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/06/6", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-5081", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467174", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5081.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-340"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-341"}]}], "descriptions": [{"lang": "en", "value": "Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure.\n\nApache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID variable is set by the Apache mod_unique_id plugin, which generates unique ids for the request. The id is based on the IPv4 address, the process id, the epoch time, a 16-bit counter and a thread index, with no obfuscation.\n\nThe server IP is often available to the public, and if not available, can be guessed from previous session ids being issued. The process ids may also be guessed from previous session ids. The timestamp is easily guessed (and leaked in the HTTP Date response header).\n\nThe purpose of mod_unique_id is to assign a unique id to requests so that events can be correlated in different logs. The id is not designed, nor is it suitable for security purposes."}, {"lang": "es", "value": "Las versiones de Apache::Session::Generate::ModUniqueId desde la 1.54 hasta la 1.94 para los IDs de sesi\u00f3n de Perl son inseguras.\n\nApache::Session::Generate::ModUniqueId (a\u00f1adido en la versi\u00f3n 1.54) utiliza el valor de la variable de entorno UNIQUE_ID para el ID de sesi\u00f3n. La variable UNIQUE_ID es establecida por el plugin Apache mod_unique_id, que genera IDs \u00fanicos para la solicitud. El ID se basa en la direcci\u00f3n IPv4, el ID de proceso, el tiempo de \u00e9poca, un contador de 16 bits y un \u00edndice de hilo, sin ofuscaci\u00f3n.\n\nLa IP del servidor a menudo est\u00e1 disponible para el p\u00fablico, y si no est\u00e1 disponible, puede adivinarse a partir de IDs de sesi\u00f3n anteriores emitidos. Los IDs de proceso tambi\u00e9n pueden adivinarse a partir de IDs de sesi\u00f3n anteriores. La marca de tiempo es f\u00e1cilmente adivinable (y se filtra en el encabezado de respuesta HTTP Date).\n\nEl prop\u00f3sito de mod_unique_id es asignar un ID \u00fanico a las solicitudes para que los eventos puedan correlacionarse en diferentes registros. El ID no est\u00e1 dise\u00f1ado, ni es adecuado para fines de seguridad."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chorny:apache\\:\\:session\\:\\:generate\\:\\:moduniqueid:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "C68EDD5C-5BA4-409E-8629-EB41AA18904F", "versionEndIncluding": "1.94", "versionStartIncluding": "1.54"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}