CVE-2025-40923

High

Description

Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

SeverityHigh

CVSS7.3

Exploit probability—

ProductPlack::Middleware::Session

PublishedJul 16, 2025

First seenJul 16, 2025

Weakness typeCWE-340CWE-340 CWE-338CWE-338

How to fix

Update

MIYAGAWA Plack::Middleware::Session0.35 or later

Patches

github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be.patch

Affected products

Product	Affected versions	Fixed in
MIYAGAWA Plack::Middleware::Session	0.01 ≤ v < 0.35	0.35

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.