CVE-2013-10075CWE-672

Apache::Session versions through 1.94 for Perl re-creates deleted sessions

Critical · published May 8, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

Apache::Session versions through 1.94 for Perl re-creates deleted sessions.

The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-672 · Operation on a Resource after Expiration or Release
Published
2026-05-08T07:44Z
EPSS history
Timeline
  • 08 MAY 07:44Z
    Apache::Session versions through 1.94 for Perl re-creates deleted sessions
    cvelistv5