PT-2026-23118 · Unknown · Apache::Session::Generate::Md5

Robert Rothenberg · Published 2026-03-05 · Updated 2026-05-15 · CVE-2025-40931

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache::Session::Generate::MD5 versions through 1.94

Description The software generates session IDs insecurely. The default session ID generator uses an MD5 hash seeded with the built-in rand() function, the epoch time, and the process ID (PID). The PID comes from a limited set of numbers, and the epoch time may be guessed. The rand() function is not suitable for cryptographic purposes. Predictable session IDs could allow an attacker to gain unauthorized access to systems.

Recommendations Update to a version of Apache::Session::Generate::MD5 later than 1.94.

Fix

Weakness Enumeration

CWE-340

CWE-338

Related Identifiers

CVE-2025-40931

Affected Products

Apache::Session::Generate::Md5

References · 24

• https://nvd.nist.gov/vuln/detail/CVE-2025-40931 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-40931 · Vendor Advisory
• https://salsa.debian.org/perl-team/modules/packages/libapache-session-perl/-/commit/bdabd71c2f91b18526e31a9dc52b4c17b3d246b7#898a4b8b00022df1b8689910b67707f3e738d180 · Patch
• https://ubuntu.com/security/CVE-2025-40931 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-40931 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-40931 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-40931 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-40931 · Vendor Advisory
• https://github.com/chorny/Apache-Session/issues/4 · Note
• https://openwall.com/lists/oss-security/2019/06/15/1 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930659 · Note
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Note
• https://twitter.com/CVEnew/status/2030755421535821970 · Twitter Post
• https://t.me/CVEtracker/46395 · Telegram Post
• http://openwall.com/lists/oss-security/2026/03/05/3 · Note