Apache::Session versions through 1.94 re-create sessions that have been deleted, specifically when using the File or DB_File stores. This flaw can result in sessions being revived, potentially restoring data that was intended to be permanently removed. The weakness is classified as CWE‑672, indicating a failure to enforce proper deletion limits or finalization of session state, leading to continued access to unintended data.

The affected product is Apache::Session from the CHORNY vendor, any installed version up to and including 1.94. The vulnerability occurs in all environments where the File or DB_File session stores are configured, such as web applications that rely on this Perl module for session management.

The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA KEV, suggesting limited exploitation activity. The CVSS score is 9.1, indicating a high severity vulnerability. The attack vector is likely local or through web interfaces that instantiate Apache::Session, where an attacker could trigger the recreation of a deleted session and access residual data. Because the flaw involves a reinstatement of a previously removed state, exploitation would require the attacker to target systems that rely on these deprecated session stores.