What is the CVSS score of CVE-2025-40931?

CVE-2025-40931 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache are affected by CVE-2025-40931?

A critical vulnerability (CVSS 9.1) affecting Apache has been disclosed with no patch currently available, creating immediate risk for any organization running vulnerable versions.

How to fix or mitigate CVE-2025-40931?

Within 24 hours: Inventory all Apache instances and identify vulnerable versions; establish incident response team and enable enhanced logging/monitoring. Within 7 days: Implement compensating controls (WAF rules, network segmentation, disable unnecessary modules); begin testing alternative or hardened Apache configurations. Within 30 days: Prioritize patching immediately upon vendor release; evaluate migration to patched versions or alternative solutions if patch timeline becomes unacceptable.

Apache CVE-2025-40931

CRITICAL

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2026-03-05 9b29abf9-4ab0-4765-b253-1875cd9b441e

Apache Information Disclosure Chorny

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SUSE

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 02:16 nvd

CRITICAL 9.1

DescriptionCVE.org

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id.

Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.