CVE-2018-25160

Published: Feb 27, 2026Modified: Mar 18, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.

Affected (1)

Products: Tokuhirom: Http\

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tokuhirom Http\	Up to 1.09

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patch

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Patch

https://metacpan.org/pod/Cache::Memcached::Fast::Safe

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Third Party Advisory

https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

ProductRelease Notes

http://www.openwall.com/lists/oss-security/2026/02/27/13

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.