CVE catalog
CVE-2025-40932
Apache::SessionX versions through 2.01 for Perl create insecure session id. Apache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 retu
- Severity
- High · CVSS 8.2
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.23% · Oct 25, 2026
Apache::SessionX versions through 2.01 for Perl create insecure session id. Apache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libapache-sessionx-perl | sid | 2.01-8 | vulnerable |
| Debian | libapache-sessionx-perl | bookworm | 2.01-5 | vulnerable |
| Cpe | libapache-sessionx-perl | Not reported | Not reported | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libapache-sessionx-perl | source | sid | (unfixed) | not yet assigned | Not reported | [930660] |
| Debian | libapache-sessionx-perl | source | bookworm | (unfixed) | not yet assigned | Not reported | [930660] |
Notes
[bookworm] libapache-sessionx-perl: Minor issue; can be handled via point release at some point after unstable fix
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libapache-sessionx-perl]Affected
Details (2)
2.01-5· all · bookwormAffected
nvd · libapache-sessionx-perl · debian · bookworm; nvd · libapache-sessionx-perl · debian · 12
2.01-5· all · bookwormAffected
nvd · libapache-sessionx-perl · debian · bookworm; nvd · libapache-sessionx-perl · debian · 12
Observed: