VulnSocial

CVE-2025-40926Disclosure(kazeburo / plack\)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predictable session ids could allow an attacker to gain access to systems. Plack::Middleware::Session::Simple is intended to be compatible with Plack::Middleware::Session, which had a similar security issue CVE-2025-40923.

kazeburo CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-338CWE-340

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • plack\

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-03-08); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
kazeburo
Products
plack\

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-03-08: 1Mentions · 2026-03-09: 1Technical Details · 2026-03-08: 1Technical Details · 2026-03-09: 103-0803-09
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-03-081
Disclosure1
2026-03-091
General1
Full discourse2 posts
  • Open Source Security mailing list@oss_security
    General

    5 CVEs in Perl CPAN modules https://www.openwall.com/lists/oss-security/2026/03/05/ CVE-2024-57854: Net::NSCA::Client versions through 0.009002 uses a poor random number generator CVE-2025-40926: Plack::Middleware::Session::Simple versions through 0.04 generates session ids insecurely + next tweet

    Post summary

    The post announces five Perl CPAN module CVEs, lists two with brief technical descriptions, and provides a link to a mailing list thread, but offers no PoC, exploit code, patch, or evidence of active exploitation.

    11051545
    4.4K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2025-40926 Plack::Middleware::Session::Simple versions through 0.04 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with… https://www.cve.org/CVERecord?id=CVE-2025-40926

    Post summary

    CVE‑2025‑40926 reveals that Plack::Middleware::Session::Simple generates insecure session IDs via a SHA‑1 hash, constituting a new vulnerability disclosure.

    00000265
    56.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appkazeburoplack\\simple-

Explore more

Back to dashboardkazeburo CVEsplack\ vulnerabilities