CVE-2026-13575 Details
Description
HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers. With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
A command injection vulnerability in the memcached storage backend of HTTP::Session versions prior to 0.54 for Perl has been identified. The issue arises from unfiltered session IDs in HTTP::Session::Store::CHI, which allow control characters to be injected. Unlike HTTP::Session::Store::Memcached', the CHI store does not validate or escape session IDs before caching them. Exploitation involves crafting a session ID with carriage return and line feed characters, which disrupts the memcached command parsing and can lead to unauthorized command execution on the server.
Users are advised to upgrade to HTTP::Session version 0.54 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tokuhirom/http-session/commit/58288cbf941da6d2aad4ff5c0c79e523d9e583b4.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/Store/CHI.pm | CPANSec | Source CodeVendor |
| https://metacpan.org/release/TOKUHIROM/http-session-0.54/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/11/01/2 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| HTTP::Session | < 0.54 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | CVE Modified | CVE |
| Nov 1, 2026 | New CVE Received | CPANSec |