CVE-2014-125112

Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution

State: Published
Severity: 9.8 Critical
Published: Mar 26, 2026
Updated: Mar 26, 2026
Reserved: Jul 8, 2025

Description

Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.

Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-565 Reliance on Cookies without Validation and Integrity Checking

Affected Products

Product	Versions
Plack::Middleware::Session::CookieMIYAGAWA	0.21 and earlierAffected

References

https://gist.github.com/miyagawa/2b8764af908a0dacd43dtechnical-description
https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changesrelease-notes
http://www.openwall.com/lists/oss-security/2026/03/26/2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.