Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2018-25160
PUBLISHED
More InfoOfficial Page
Assigner-CPANSec
Assigner Org ID-9b29abf9-4ab0-4765-b253-1875cd9b441e
View Known Exploited Vulnerability (KEV) details
Published At-27 Feb, 2026 | 20:15
Updated At-27 Feb, 2026 | 20:15
Rejected At-
▼CVE Numbering Authority (CNA)
HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.

Affected Products
Vendor
TOKUHIROM
Product
HTTP::Session2
Collection URL
https://cpan.org/modules
Package Name
HTTP-Session2
Repo
https://github.com/tokuhirom/HTTP-Session2
Default Status
unaffected
Versions
Affected
  • From 0 through 1.09 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-20CWE-20 Improper Input Validation
Type: CWE
CWE ID: CWE-20
Description: CWE-20 Improper Input Validation
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-248CAPEC-248 Command Injection
CAPEC ID: CAPEC-248
Description: CAPEC-248 Command Injection
Solutions

HTTP::Session2 has been deprecated since version 1.11, users are recommended to migrate to a different solution.

Configurations
Workarounds

Upgrade to version 1.10 or later. Use a session storage module that offers protection against command injections, such as Cache::Memcached::Fast::Safe.

Exploits
Credits
Timeline
EventDate
version 1.10 HTTP::Session2 released with fix.2018-01-26 00:00:00
version 1.11 HTTP::Session2 deprecated.2026-02-24 00:00:00
Event: version 1.10 HTTP::Session2 released with fix.
Date: 2018-01-26 00:00:00
Event: version 1.11 HTTP::Session2 deprecated.
Date: 2026-02-24 00:00:00
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patch
patch
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes
release-notes
https://metacpan.org/pod/Cache::Memcached::Fast::Safe
related
Hyperlink: https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patch
Resource:
patch
Hyperlink: https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes
Resource:
release-notes
Hyperlink: https://metacpan.org/pod/Cache::Memcached::Fast::Safe
Resource:
related
Details not found