CVE-2018-25160
HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend
- State
- Published
- Severity
- 6.5 Medium
- Published
- Feb 27, 2026
- Updated
- Mar 3, 2026
- Reserved
- Feb 26, 2026
Description
HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend.
For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
HTTP::Session2TOKUHIROM |
|
References
- https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patchpatch
- https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changesrelease-notes
- https://metacpan.org/pod/Cache::Memcached::Fast::Saferelated
- http://www.openwall.com/lists/oss-security/2026/02/27/13
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.