CVE-2025-40924

Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely. The session id is generated from a (usually SHA-1) hash of a simple counter, the epoch time, the built-in rand function, the PID and the current Catalyst context. This information is of low entropy. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

• CWE-338
• CWE-340

• https://github.com/perl-catalyst/Catalyst-Plugin-Session/commit/c0e2b4ab1e42ebce1008286db8c571b6ee98c22c.patch
• https://github.com/perl-catalyst/Catalyst-Plugin-Session/pull/5
• https://metacpan.org/release/HAARG/Catalyst-Plugin-Session-0.43/source/lib/Catalyst/Plugin/Session.pm#L632

Published

Jul 17, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-40916Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a…9.1
• CVE-2025-40918Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 …6.5
• CVE-2025-40919Authen::DigestMD5 versions 0.01 through 0.02 for Perl genera…6.5
• CVE-2025-4092Memory safety bugs present in Firefox 137 and Thunderbird 13…6.5
• CVE-2025-40920Catalyst::Authentication::Credential::HTTP versions 1.018 an…8.6
• CVE-2025-40923Plack-Middleware-Session before version 0.35 for Perl genera…7.3
• CVE-2025-40925Starch versions 0.14 and earlier generate session ids insecu…9.1
• CVE-2025-40926Plack::Middleware::Session::Simple versions before 0.05 for …9.8
• CVE-2025-40927CGI::Simple versions before 1.282 for Perl has a HTTP respon…7.3
• CVE-2025-40928JSON::XS before version 4.04 for Perl has an integer buffer …7.5
• CVE-2025-40929Cpanel::JSON::XS before version 4.40 for Perl has an integer…5.6
• CVE-2025-4093Memory safety bug present in Firefox ESR 128.9, and Thunderb…8.1