CVE-2024-55603: Custom Session Handler Missing Expiration Checkcve-2024-55603-custom-session-handler-missing-expiration-check
A custom session handler implements the `read` method using database queries without checking the session's expiration time. PHP's internal garbage collection (`gc`) is only called probabilistically based on `session.gc_probability` and `session.gc_divisor`. Consequently, expired sessions remain in the data store for an unpredictable amount of time, allowing
