CVE-2025-15578

Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely

State: Published
Severity: 9.8 Critical
Published: Feb 16, 2026
Updated: Feb 17, 2026
Reserved: Feb 12, 2026

Description

Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Affected Products

Product	Versions
MaypoleTEEJAY	2.10 through 2.13Affected

References

https://metacpan.org/dist/Maypole/source/lib/Maypole/Session.pm#L43related

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.