CVE-2025-15578CWE-338

Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely

Critical · published February 16, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
24.0
In the wild
Unconfirmed
What it is

Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00323 · 24.0th percentile
Weakness
CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published
2026-02-16T21:18Z
EPSS history
Timeline
  • 16 FEB 21:18Z
    Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely
    cvelistv5