Insecure Session ID Generation in Apache::Session::Generate::MD5 for Perl

CVE-2025-40931

What is CVE-2025-40931?

The Apache::Session::Generate::MD5 module in Perl creates session IDs that are predictable due to the use of the built-in rand() function along with a combination of the epoch time and process ID. The limited range of potential process IDs and the potential for an attacker to guess the epoch time, especially if exposed in the HTTP headers, weakens session security. This can result in compromised session integrity, allowing unauthorized access to sensitive systems.

References