Medium severity6.5NVD Advisory· Published Feb 27, 2026· Updated Jun 17, 2026
CVE-2018-25160
CVE-2018-25160
Description
HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend.
For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: <=1.09
- TOKUHIROM/HTTP::Session2v5Range: 0
Patches
Vulnerability mechanics
References
4- github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patchnvdPatch
- www.openwall.com/lists/oss-security/2026/02/27/13nvdMailing ListThird Party Advisory
- metacpan.org/pod/Cache::Memcached::Fast::SafenvdThird Party Advisory
- metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/ChangesnvdProductRelease Notes
News mentions
0No linked articles in our index yet.