CVE-2025-15578: Teejay Maypole

Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.

Affected products

• Teejay Maypole: from 2.10, up to and including 2.13; version 2.111 only; version 2.121 only

Published 2026-02-16. Last modified 2026-06-17.