Starch vulnerabilities

1 known vulnerability in Starch from BLUEFEET. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Starch: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

  CVE-2025-40925Sep 20, 2025BLUEFEET

  Starch versions 0.14 and earlier generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with a counter, the epoch time, the built-in rand function, the PID, and internal Perl reference addresses. The PID will come from a