For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| TOKUHIROM | HTTP::Session2 | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
HTTP::Session2 has been deprecated since version 1.11, users are recommended to migrate to a different solution.
Workaround
Upgrade to version 1.10 or later. Use a session storage module that offers protection against command injections, such as Cache::Memcached::Fast::Safe.
Sat, 28 Feb 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 27 Feb 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value. | |
| Title | HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend | |
| Weaknesses | CWE-20 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-02-28T00:15:29.050Z
Reserved: 2026-02-26T11:50:05.854Z
Link: CVE-2018-25160
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-02-27T21:16:03.590
Modified: 2026-02-28T01:16:04.347
Link: CVE-2018-25160
Redhat
No data.
OpenCVE Enrichment
No data.