Apache::Session::Generate::MD5 vulnerabilities

1 known vulnerability in Apache::Session::Generate::MD5 from Chorny. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Apache::Session::Generate::MD5: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

  CVE-2025-40931Mar 5, 2026Chorny

  Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch t