The following vulnerability was published for libplack-middleware-session-perl.
CVE-2025-40923[0]:
| Plack-Middleware-Session before version 0.35 for Perl generates
| session ids insecurely. The default session id generator returns a
| SHA-1 hash seeded with the built-in rand function, the epoch time,
| and the PID. The PID will come from a small set of numbers, and the
| epoch time may be guessed, if it is not leaked from the HTTP Date
| header. The built-in rand function is unsuitable for cryptographic
| usage. Predicable session ids could allow an attacker to gain
| access to systems.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.