Vulnerability · Published Feb 26, 2026 · Assigned by CPANSec
CVE-2025-40932Apache::SessionX versions through 2.01 for Perl create insecure session id
High 8.2
In plain English
A high-severity security flaw in Apache::SessionX from GRICHTER. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
Apache::SessionX versions through 2.01 for Perl create insecure session id. Apache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libapache-sessionx-perl | no fix listed | DEBIAN-CVE-2025-40932 |
| Ubuntu:22.04:LTS | libapache-sessionx-perl | no fix listed | UBUNTU-CVE-2025-40932 |
| Ubuntu:24.04:LTS | libapache-sessionx-perl | no fix listed | UBUNTU-CVE-2025-40932 |
| Ubuntu:25.10 | libapache-sessionx-perl | no fix listed | UBUNTU-CVE-2025-40932 |
| Ubuntu:26.04:LTS | libapache-sessionx-perl | no fix listed | UBUNTU-CVE-2025-40932 |
| Ubuntu:26.10 | libapache-sessionx-perl | no fix listed | UBUNTU-CVE-2025-40932 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GRICHTER | Apache::SessionX | 0 – through 2.01 |
Weakness: CWE-340, CWE-338 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N