Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems. Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module. This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-19d80281b7 advisory.

    This update has improvements to generate more secure session IDs (CVE-2026-8503).


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e8ef64b8d3 advisory.

    This update has improvements to generate more secure session IDs (CVE-2026-8503).


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.
    Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator     returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again.
    These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access     to systems. Note that version 1.3.19 has a fallback without warning to use insecure session generation     method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a     hardcoded requirement of the module. This issue is similar to CVE-2025-40931 for     Apache::Session::Generate::MD5. (CVE-2026-8503)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
316616	Fedora 44 : perl-Apache-Session-Browseable (2026-19d80281b7)	Nessus	Fedora Local Security Checks	medium
316614	Fedora 43 : perl-Apache-Session-Browseable (2026-e8ef64b8d3)	Nessus	Fedora Local Security Checks	medium
314981	Linux Distros Unpatched Vulnerability : CVE-2026-8503	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-8503

medium

Tenable Plugins

medium

medium

medium