CVE-2018-25160
Medium
Description
HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.
SeverityMedium
CVSS6.5
Exploit probability—
ProductTokuhirom Http\
PublishedFeb 27, 2026
First seenFeb 27, 2026
Weakness typeCWE-20Improper input validation
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tokuhirom http\ | \ ≤ v ≤ 1.09 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.