Apache::Session::Generate::MD5 versions through 1.94 generate session IDs insecurely by using MD5 hashes seeded with the built-in rand() function, epoch time, and PID. The rand() function is unsuitable for cryptographic purposes, and the PID and epoch time values are predictable or guessable, leading to predictable session identifiers. This vulnerability (CVE-2025-40931) can allow attackers to predict session IDs and potentially gain unauthorized access to systems relying on these sessions. Some Debian-based Linux distributions have mitigated this issue by patching the libapache-session-perl package to use Crypt::URandom instead of the insecure generator. No official patch or vendor advisory is currently available for the original Apache::Session::Generate::MD5 module.

The vulnerability allows attackers to predict session IDs due to weak randomness in the generation process. This can lead to session hijacking and unauthorized access to systems using the affected Apache::Session::Generate::MD5 module. The CVSS score of 9.1 reflects high confidentiality and integrity impact with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a mitigation, users of Debian-based distributions should verify if their libapache-session-perl package has been patched to use Crypt::URandom instead of the vulnerable MD5 generator. Until an official fix is available, consider replacing Apache::Session::Generate::MD5 with a cryptographically secure session ID generator.