CVE-2014-125112
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.
Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.
Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.
- Record
CVE-2014-125112- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-565
- Updated
- 2026-11-02
EUVDEUVD-2014-9820
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.
Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.
- Record
EUVD-2014-9820- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-58qr-v987-vh6w
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. ...
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.
Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.
- Record
GHSA-58qr-v987-vh6w- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-565
- Updated
- 2026-11-02
NVD
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.
Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.
- Record
CVE-2014-125112- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-565
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-125112
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.
- Record
DEBIAN-CVE-2014-125112- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-125112
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.
- Record
UBUNTU-CVE-2014-125112- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libplack-middleware-session-perlDebian:12 |
before 0.24-1 | 0.24-1 |
libplack-middleware-session-perlDebian:13 |
before 0.24-1 | 0.24-1 |
libplack-middleware-session-perlDebian:14 |
before 0.24-1 | 0.24-1 |
libplack-middleware-session-perlUbuntu:16.04:LTS |
All versions, plus listed versions 0.30-1 |
None known |
libplack-middleware-session-perlUbuntu:18.04:LTS |
All versions, plus listed versions 0.30-10.30-2 |
None known |
libplack-middleware-session-perlUbuntu:20.04:LTS |
All versions, plus listed versions 0.32-10.33-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-125112 is a critical vulnerability (CVSS 9.8) in Miyagawa Plack::middleware::session::cookie, published March 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in libplack-middleware-session-perl 0.24-1.
References
gist.github.com/miyagawa/2b8764af908a0dacd43d
metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes
openwall.com/lists/oss-security/2026/03/26/2
nvd.nist.gov/vuln/detail/CVE-2014-125112
github.com/advisories/GHSA-58qr-v987-vh6w
security-tracker.debian.org/tracker/CVE-2014-125112
ubuntu.com/security/CVE-2014-125112
cve.org/CVERecord?id=CVE-2014-125112
lists.security.metacpan.org/cve-announce/msg/38287006