Apache::Session versions through 1.94 re-create sessions that have been deleted, specifically when using the File or DB_File stores. This flaw can result in sessions being revived, potentially restoring data that was intended to be permanently removed. The weakness is classified as CWE‑672, indicating a failure to enforce proper deletion limits or finalization of session state, leading to continued access to unintended data.

The affected product is Apache::Session from the CHORNY vendor, any installed version up to and including 1.94. The vulnerability occurs in all environments where the File or DB_File session stores are configured, such as web applications that rely on this Perl module for session management.

No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting limited or unknown exploitation activity. The CVSS score is not provided, so the impact severity cannot be precisely quantified. The attack vector is likely local or through web interfaces that instantiate Apache::Session, where an attacker could trigger the recreation of a deleted session and access residual data. Because the flaw involves a reinstatement of a previously removed state, exploitation would require the attacker to target systems that rely on these deprecated session stores.