CVE-2025-40931

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/chorny/Apache-Session/issues/4	Issue Tracking
https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm#L27	Product
https://rt.cpan.org/Ticket/Display.html?id=173631	Third Party Advisory
https://security.metacpan.org/docs/guides/random-data-for-security.html	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/03/05/3	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:chorny:apache\:\:session\:\:generate\:\:md5:*:*:*:*:*:perl:*:*

History

No history.

Information

Published : 2026-03-05 02:16

Updated : 2026-03-09 14:41

NVD link : CVE-2025-40931

Mitre link : CVE-2025-40931

CVE.ORG link : CVE-2025-40931

JSON object : View

Products Affected

chorny

apache\

CWE

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-340

Generation of Predictable Numbers or Identifiers

{"id": "CVE-2025-40931", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2026-03-05T02:16:39.960", "references": [{"url": "https://github.com/chorny/Apache-Session/issues/4", "tags": ["Issue Tracking"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm#L27", "tags": ["Product"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://rt.cpan.org/Ticket/Display.html?id=173631", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/03/05/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-340"}]}], "descriptions": [{"lang": "en", "value": "Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id.\n\nApache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems."}, {"lang": "es", "value": "Las versiones de Apache::Session::Generate::MD5 hasta la 1.94 para Perl crean un ID de sesi\u00f3n inseguro.\n\nApache::Session::Generate::MD5 genera IDs de sesi\u00f3n de forma insegura. El generador de ID de sesi\u00f3n predeterminado devuelve un hash MD5 inicializado con la funci\u00f3n rand() incorporada, el tiempo de \u00e9poca y el PID. El PID provendr\u00e1 de un peque\u00f1o conjunto de n\u00fameros, y el tiempo de \u00e9poca puede ser adivinado, si no se filtra del encabezado HTTP Date. La funci\u00f3n rand incorporada no es adecuada para uso criptogr\u00e1fico. Los IDs de sesi\u00f3n predecibles podr\u00edan permitir a un atacante obtener acceso a los sistemas."}], "lastModified": "2026-03-09T14:41:36.327", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chorny:apache\\:\\:session\\:\\:generate\\:\\:md5:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "D04C726E-3C53-423A-8F6D-C2DC97BD228F", "versionEndIncluding": "1.94"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}