CVE-2018-25160CWE-20

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend

Medium · published February 27, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.3
In the wild
Unconfirmed
What it is

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend.

For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-02-27T20:15Z
EPSS history
Timeline
  • 27 FEB 20:15Z
    HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend
    cvelistv5