CVE-2025-40931 Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id

Critical 9.1 Published 5 Mar 2026 Updated 21 Apr 2026

Insecure session ID generation in Apache::Session::Generate::MD5 allows attackers to predict IDs and hijack user sessions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-40931?

CVE-2025-40931 is a critical vulnerability in CHORNY Apache::Session::Generate::MD5, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id.

Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

Note that the libapache-session-perl package in some Debian-based Linux distributions may be patched to use Crypt::URandom.

Weakness: CWE-340, CWE-338

Which versions are affected by CVE-2025-40931?

It affects 1 product.

Products include Chorny Apache\.

How do I fix CVE-2025-40931?

No fix has been published for CVE-2025-40931 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-40931 being exploited?

There is no known exploitation of CVE-2025-40931 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2025-40931, GHSA-32fg-c88m-mcrv, UBUNTU-CVE-2025-40931.