Cyber Resilience

CVE-2013-10075

Chorny Apache\ \

Published
08 May 2026
Modified
16 June 2026
CVSS Score v3.1 9.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0036 28th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2013-10075 is a critical-severity Operation on a Resource after Expiration or Release (CWE-672) vulnerability in Chorny Apache\. Its CVSS base score is 9.1 (Critical).

Operationally, ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted.

CWE(s)
CWE-672

Related Threats

CVEs Like This One

CVE-2026-5081Same product: Chorny Apache\
CVE-2025-40931Same product: Chorny Apache\
CVE-2023-34326Shared CWE-672
CVE-2026-4053Shared CWE-672
CVE-2024-56674Shared CWE-672
CVE-2025-53901Shared CWE-672
CVE-2026-56314Shared CWE-672
CVE-2024-23332Shared CWE-672
CVE-2026-45005Shared CWE-672
CVE-2025-21117Shared CWE-672

Affected Assets

chorny
apache\
\

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforcing managed authorizations and revocations directly prevents post-release operations on credentials or entitlements.

PR.PS-06 mostly match
prevents

Secure development practices eliminate the root coding flaw that permits use-after-release.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect use-after-release but does not prevent it at runtime.

A.8.10 Information deletion partial match
degrades

Enforces timely deletion of resources so they cannot be used after release.

A.8.28 Secure coding partial match
prevents

Secure-coding rules require checks that prevent operations on freed or expired objects.

A.8.32 Change management partial match
prevents

Change-management processes can introduce or remove resource-lifetime controls.

References