{"id":"CVE-2026-13575","aliases":["EUVD-2026-114833","GHSA-6f9x-5fgh-99f6"],"status":"published","title":"HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI","description":"HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.\n\nThe session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.\n\nWith a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0107,"percentile":0.65135,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-93"],"published":"2026-11-01T10:46:36Z","modified":"2026-11-09T18:31:46Z","references":[{"url":"https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/Store/CHI.pm","tags":["web"]},{"url":"https://github.com/tokuhirom/http-session/commit/58288cbf941da6d2aad4ff5c0c79e523d9e583b4.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/TOKUHIROM/http-session-0.54/changes","tags":["release-notes","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/01/2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13575","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6f9x-5fgh-99f6"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13575.json","tags":["advisory"]},{"url":"https://github.com/tokuhirom/http-session","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-13575","title":"HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI","description":"HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.\n\nThe session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.\n\nWith a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.","status":"published","published":"2026-11-01T10:46:36.389Z","modified":"2026-11-09T17:04:47.552Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-93"],"updated_at":"2026-11-09T19:34:29.555364Z"}],"euvd":[{"id":"EUVD-2026-114833","description":"HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.\n\nThe session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.\n\nWith a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.","status":"published","published":"2026-11-01T10:46:36Z","modified":"2026-11-09T17:04:47Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-09T18:17:39.592818Z"}],"ghsa":[{"id":"GHSA-6f9x-5fgh-99f6","title":"HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered...","description":"HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.\n\nThe session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.\n\nWith a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.","status":"published","published":"2026-11-01T12:30:23Z","modified":"2026-11-09T18:31:46Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-09T18:49:19.883486Z"}],"nvd":[{"id":"CVE-2026-13575","description":"HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.\n\nThe session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.\n\nWith a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.","status":"published","published":"2026-11-01T11:18:58.04Z","modified":"2026-11-09T17:17:28.44Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-93"],"updated_at":"2026-11-09T20:15:33.452303Z"}],"osv":[{"id":"CVE-2026-13575","title":"HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI","description":"HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.\n\nThe session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.\n\nWith a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.","status":"published","published":"2026-11-01T10:46:36.389Z","modified":"2026-11-10T02:31:51.601541476Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-10T02:45:42.584685Z"}]}}