CVE-2014-125112 Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution

Critical 9.8 Published 26 Mar 2026 Updated 26 Mar 2026

Attackers can execute arbitrary code on servers using Plack::Middleware::Session::Cookie if the cookie signing secret is not configured.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-125112?

CVE-2014-125112 is a critical unsafe deserialization vulnerability in MIYAGAWA Plack::Middleware::Session::Cookie, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.

Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.

Weakness: CWE-565

Which versions are affected by CVE-2014-125112?

It affects 1 product.

Products include Miyagawa Plack\.

How do I fix CVE-2014-125112?

Apply the vendor's patch.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2014-125112 being exploited?

There is no known exploitation of CVE-2014-125112 in the wild and no public exploit code.

CVE-2026-7381 Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting Critical 9.1

Sources

Also known as DEBIAN-CVE-2014-125112, GHSA-58qr-v987-vh6w, UBUNTU-CVE-2014-125112.