CVE-2025-40931

March 6, 2026, 4:15 a.m.

9.1
Critical

Description

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

Product(s) Impacted

Vendor Product Versions
Apache
  • Session Generate Md5
  • <1.94

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-338
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a apache session_generate_md5 <1.94 / / / / / / /

References

https://github.com/chorny/Apache-Session/issues/4
https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm#L27
https://rt.cpan.org/Ticket/Display.html?id=173631
https://security.metacpan.org/docs/guides/random-data-for-security.html
http://www.openwall.com/lists/oss-security/2026/03/05/3

Tags

CWE-338
9b29abf9-4ab0-4765-b253-1875cd9b441e
2026-03-05
CVE-2025-40931

CVSS Score

9.1 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

    View Vector String

Timeline

Published: March 5, 2026, 2:16 a.m.
Last Modified: March 6, 2026, 4:15 a.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

9b29abf9-4ab0-4765-b253-1875cd9b441e

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.