CVE-2026-13575
Received Received - Intake

Memcached Command Injection in HTTP::Session for Perl

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: CPANSec

Description
HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers. With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-13575

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memcached command injection flaw in HTTP::Session versions before 0.54 for Perl. It occurs because session IDs from client cookies are passed unchanged to the CHI cache, which does not filter control characters like the Memcached store does. Attackers can inject CR and LF characters into session IDs to manipulate memcached commands, potentially executing unauthorized commands on the server.

Detection Guidance

Check Perl applications using HTTP::Session with CHI-based session storage for session IDs containing control characters or excessive length. Inspect logs for memcached command injection attempts or unusual session ID patterns.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary commands on the memcached server, leading to data breaches, unauthorized access, or denial of service. Systems using HTTP::Session with a memcached backend and unfiltered session IDs are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Compliance may be compromised if sensitive data is exposed due to the flaw.

Mitigation Strategies

Upgrade HTTP::Session to version 0.54 or later. If upgrading is not possible, implement input validation to filter session IDs for control characters and enforce length limits before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13575. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...