HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI
Affects HTTP::Session before 0.54 when HTTP::Session::Store::CHI is used with memcached. Fixed in 0.54.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 0/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 0.54
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
HTTP::Session for Perl, before version 0.54, is affected when it uses its CHI-based session store with a memcached backend. A crafted session ID in a client cookie can inject extra commands into the memcached protocol, allowing an attacker to manipulate data stored in the cache.
Read the original description
HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers. With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
What to do
Upgrade to a fixed version: 0.54.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- http-session
fixed in 0.54
Evidence 3
- Patch
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-13575
What does this mean?
Session IDs were passed to CHI without filtering, so a crafted session ID could inject commands into the memcached protocol. The bug is in how HTTP::Session::Store::CHI handles session IDs before they reach CHI.Source: github.com
Am I affected, and how do I check?
Versions of HTTP::Session before 0.54 are affected, but only where HTTP::Session::Store::CHI is used. To check, look at the installed HTTP::Session version (for example, with perl -MHTTP::Session -e 'print $HTTP::Session::VERSION') and whether the application's session store is set to CHI.Source: github.com
What should I do about it?
Upgrade HTTP::Session to version 0.54 or later.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data