CVE-2025-40931 Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id

🗓️ 05 Mar 2026 01:41:09Reported by CPANSecType

Insecure session IDs in Apache::Session::Generate::MD5 due to predictable MD5 seed from rand, time, and PID.

Reporter	Title	Published	Views	Family All 18
ATTACKERKB	CVE-2025-40931	5 Mar 202601:41	–	attackerkb
ATTACKERKB	CVE-2026-8503	15 May 202611:06	–	attackerkb
Circl	CVE-2025-40931	5 Mar 202605:52	–	circl
CNNVD	Apache::Session::Generate::MD5 安全漏洞	5 Mar 202600:00	–	cnnvd
CVE	CVE-2025-40931	5 Mar 202601:41	–	cve
Debian CVE	CVE-2025-40931	5 Mar 202601:41	–	debiancve
EUVD	EUVD-2025-208297	5 Mar 202603:31	–	euvd
EUVD	EUVD-2026-30536	15 May 202611:06	–	euvd
NVD	CVE-2025-40931	5 Mar 202602:16	–	nvd
OSV	DEBIAN-CVE-2025-40931	5 Mar 202602:16	–	osv

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "packageName": "Apache-Session",
    "product": "Apache::Session::Generate::MD5",
    "programFiles": [
      "lib/Session/Generate/MD5.pm"
    ],
    "repo": "https://github.com/chorny/Apache-Session",
    "vendor": "CHORNY",
    "versions": [
      {
        "lessThanOrEqual": "1.94",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
metacpan	www.metacpan.org/pod/Apache::Session::Generate::Random
openwall	www.openwall.com/lists/oss-security/2019/06/15/1
security	www.security.metacpan.org/docs/guides/random-data-for-security.html
gitlab	www.gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/1633
metacpan	www.metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm
bugs	www.bugs.debian.org/cgi-bin/bugreport.cgi
salsa	www.salsa.debian.org/perl-team/modules/packages/libapache-session-perl/-/commit/bdabd71c2f91b18526e31a9dc52b4c17b3d246b7
github	www.github.com/chorny/Apache-Session/issues/4
rt	www.rt.cpan.org/Ticket/Display.html

12 Apr 2026 17:19Current

EPSS0.00583