CVE-2026-13575

Full vulnerability record from the local CVENow database.

Description

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers. With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

9b29abf9-4ab0-4765-b253-1875cd9b441e

Published

2026-11-01 11:18:58.040000

Last modified

2026-11-01 11:18:58.040000

View original CVE JSON

{
  "id": "CVE-2026-13575",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-11-01T11:18:58.040",
  "lastModified": "2026-11-01T11:18:58.040",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.\n\nThe session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.\n\nWith a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "http-session",
          "modules": [
            "HTTP::Session"
          ],
          "programFiles": [
            "lib/HTTP/Session/Store/CHI.pm"
          ],
          "programRoutines": [
            {
              "name": "HTTP::Session::Store::CHI::select"
            },
            {
              "name": "HTTP::Session::Store::CHI::insert"
            },
            {
              "name": "HTTP::Session::Store::CHI::update"
            },
            {
              "name": "HTTP::Session::Store::CHI::delete"
            }
          ],
          "repo": "https://github.com/tokuhirom/http-session",
          "packageURL": "pkg:cpan/http-session",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.54",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/tokuhirom/http-session/commit/58288cbf941da6d2aad4ff5c0c79e523d9e583b4.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/Store/CHI.pm",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/TOKUHIROM/http-session-0.54/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}