The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.
With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to http-session 0.54 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 01 Nov 2026 11:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers. With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands. | |
| Title | HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI | |
| Weaknesses | CWE-93 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-01T10:46:36.389Z
Reserved: 2026-06-28T20:29:06.153Z
Link: CVE-2026-13575
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-01T11:18:58.040
Modified: 2026-11-01T11:18:58.040
Link: CVE-2026-13575
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-93
Improper Neutralization of CRLF Sequences ('CRLF Injection')