Read the docs
TI-2026-83613 Aliases CVE-2026-13575GHSA-6f9x-5fgh-99f6

Memcached command injection in HTTP::Session via unfiltered session ids

Priority LOW 33CWE-93Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA.

Summary

HTTP::Session for Perl before 0.54 allows memcached command injection through session ids that are not filtered in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged, and CHI does not escape keys for its memcached drivers. With a memcached driver, a carriage return and line feed in the session id end the cache command early, so the server reads the following bytes as further commands. The sources do not state the required privileges or the attacker position.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers. With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00933 60th percentileScored 2026-11-07
Fix Fixed http-session: 0.54

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—http-sessionbefore 0.540.54Patch availableCNA
  • http-session Vendor— Affected before 0.54 Fixed in 0.54 Patch available CNA

Remediation

Update http-session to version 0.54 or later, which fixes this issue. The sources list no fixed version for HTTP::Session::Store::CHI beyond that release.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA http-session Fixed in 0.54

Timeline

  1. 2026-11-01 Threatist record created from CVE-2026-13575
  2. 2026-11-01 Alias added: GHSA-6f9x-5fgh-99f6
  3. 2026-11-06 CISA SSVC decision points changed

References

Patch 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences