PT-2025-38638 · Starch · Starch

Published 2025-09-20 · Updated 2025-09-21 · CVE-2025-40925

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Starch versions 0.14 and earlier

Description Starch generates session IDs insecurely. The default session ID generator returns a SHA-1 hash seeded with a counter, the epoch time, the built-in rand function, the PID, and internal Perl reference addresses. The PID will come from a small set of numbers, and the epoch time may be guessed. The rand function is unsuitable for cryptographic usage. Predictable session IDs could allow an attacker to gain access to systems.

Recommendations Update Starch to a version later than 0.14.

Fix

Weakness Enumeration

CWE-340

CWE-338

Related Identifiers

CVE-2025-40925

Affected Products

Starch

References · 8

• https://github.com/bluefeet/Starch/commit/5573449e64e0660f7ee209d1eab5881d4ccbee3b.patch · Patch
• https://osv.dev/vulnerability/CVE-2025-40925 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40925 · Security Note
• https://github.com/bluefeet/Starch/pull/5 · Note
• https://metacpan.org/dist/Starch/source/lib/Starch/Manager.pm · Note
• https://twitter.com/CVEnew/status/1969482351580496010 · Twitter Post
• https://t.me/CVEtracker/32997 · Telegram Post
• https://twitter.com/offseq/status/1969552449733054484 · Twitter Post