Apache vulnerabilities

2 known vulnerabilities in Apache from Chorny. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  Apache::Session::Generate::ModUniqueId: Generation of Predictable Numbers or Identifiers

  CVE-2026-5081May 6, 2026Chorny

  Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID vari

• 9.1 Critical severity

  Apache::Session::Generate::MD5: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

  CVE-2025-40931Mar 5, 2026Chorny

  Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch t