CVE-2018-25160 - HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend

Back Back to CVE browser

MEDIUM

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend

Published Feb 27, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.41%

Description

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend.

For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.

Affected products

Vendor Tokuhirom Product n/a Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.09

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tokuhirom

n/a

unaffected

Version	Status	Constraints
0	affected	<=1.09

Remediation

Vendor solution

HTTP::Session2 has been deprecated since version 1.11, users are recommended to migrate to a different solution.

Weaknesses (1)

CWE-20

Improper Input Validation

References (5)

http://www.openwall.com/lists/oss-security/2026/02/27/13
Mailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-21615
Advisory
https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patch
patch
https://metacpan.org/pod/Cache::Memcached::Fast::Safe
relatedThird Party Advisory
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes
release-notesProductRelease Notes

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/02/27/13		Mailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-21615		Advisory
https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patch		patch
https://metacpan.org/pod/Cache::Memcached::Fast::Safe		relatedThird Party Advisory
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes		release-notesProductRelease Notes