CVE-2015-10149: Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine

Reported by oss-security

Summary by Cyber Security News14 Nov 2026, 21:28 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/712

Posted by Robert Rothenberg on Nov 14 CVE-2015-10149 CPAN Security Group CVE ID: CVE-2015-10149 Distribution: Dancer Versions: before 1.3400 MetaCPAN: https://metacpan.org/dist/Dancer VCS Repo:...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

libdca (VideoLAN DTS decoder, unmaintained): out-of-bounds read in scale-factor parsing

CVE-2026-128240: GPAC/MP4Box: Use-After-Free in gf_sg_proto_del During XMT Scene Teardown

CVE-2026-124031: GPAC/MP4Box: Type Confusion in Appearance Handling via Crafted XMT Input

CVE-2026-124030: GPAC/MP4Box: Type Confusion in XMT Field-Replace Commands

CVE-2011-10042: HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached

JSON-XS versions before 4.05 for Perl (7 CVEs)