CVE catalog

CVE-2025-40923

libplack-middleware-session-perl: CVE-2025-40923

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.39% · Oct 25, 2026

Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibplack-middleware-session-perlsid0.36-1fixed
Debianlibplack-middleware-session-perlforky0.36-1fixed
Debianlibplack-middleware-session-perltrixie0.34-1vulnerable
Debianlibplack-middleware-session-perlbookworm0.33-2vulnerable
Ubuntulibplack-middleware-session-perl16.040.30-1vulnerable
Ubuntulibplack-middleware-session-perl18.040.30-1vulnerable
Ubuntulibplack-middleware-session-perl18.040.30-2vulnerable
Ubuntulibplack-middleware-session-perl20.040.32-1vulnerable
Ubuntulibplack-middleware-session-perl20.040.33-1vulnerable
Ubuntulibplack-middleware-session-perl22.040.33-1vulnerable
Ubuntulibplack-middleware-session-perl24.040.33-2vulnerable
Ubuntulibplack-middleware-session-perl25.100.34-1vulnerable
Ubuntulibplack-middleware-session-perl25.100.36-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibplack-middleware-session-perlsourcesid0.36-1not yet assignedNot reported[1109405]
Debianlibplack-middleware-session-perlsourceforky0.36-1not yet assignedNot reported[1109405]
Debianlibplack-middleware-session-perlsourcetrixie(unfixed)not yet assignedNot reported[1109405]
Debianlibplack-middleware-session-perlsourcebookworm(unfixed)not yet assignedNot reported[1109405]

[Debian bug #1109405]

Notes

[trixie] libplack-middleware-session-perl: Minor issue [bookworm] libplack-middleware-session-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libplack-middleware-session-perl]Affected
    Details (2)

    • 0.33-2 · all · bookworm

      Affected

      dsa · libplack-middleware-session-perl · debian · bookworm; dsa · libplack-middleware-session-perl · debian · 12

    • 0.33-2 · all · bookworm

      Affected

      dsa · libplack-middleware-session-perl · debian · bookworm; dsa · libplack-middleware-session-perl · debian · 12

[Debian 13 (Trixie)]

  • [libplack-middleware-session-perl]Affected
    Details (2)

    • 0.34-1 · all · trixie

      Affected

      dsa · libplack-middleware-session-perl · debian · 13

    • 0.34-1 · all · trixie

      Affected

      dsa · libplack-middleware-session-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]