VulnerabilityPublished 1 Nov 2026

CVE-2026-13575: HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session

Source GCVE Database

Compare

Authoritative record:CVE-2026-13575· High

Not known to be exploited : upgrade to 0.54 soon.

Data as of 1 Nov 2026, 13:02 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in 0.54

Exploitation evidence

Disclosed: evidence found.
CVE published 1 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 1 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-6f9x-5fgh-99f6

What to do

Upgrade http-session (Perl module) to 0.54.

Affected software

Product	Affected	Fixed in
http-session	Affected <0.54	Fixed in 0.54
CPANhttp-session`pkg:cpan/http-session`Other threats	Affected <0.54	Fixed in 0.54

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Users should upgrade HTTP::Session to version 0.54 or later, where this vulnerability is addressed. Additionally, avoid using HTTP::Session::Store::CHI with memcached drivers if untrusted session IDs cannot be sanitized.

Description

HTTP::Session versions before 0.54 for Perl contain a vulnerability in the HTTP::Session::Store::CHI module that allows memcached command injection via unfiltered session IDs. The session ID from the client's cookie is passed unchanged to the CHI cache, which does not validate or escape keys for memcached drivers. This allows an attacker to inject control characters (CR and LF) into the session ID, prematurely ending the cache command and causing the server to interpret subsequent bytes as additional commands.

Impact

An attacker can exploit this vulnerability by injecting specially crafted session IDs containing control characters, leading to memcached command injection. This may allow the attacker to manipulate the memcached server's behavior, potentially leading to cache poisoning, data manipulation, or denial of service. However, no known exploits in the wild have been reported as of the published date.

Summary

The vulnerability in HTTP::Session versions prior to 0.54 affects the HTTP::Session::Store::CHI module when used with memcached drivers. Unlike the sibling HTTP::Session::Store::Memcached module, which rejects session IDs containing control characters, the CHI store does not perform such validation or escaping. This lack of input sanitization allows an attacker to craft session IDs containing carriage return and line feed characters, enabling memcached command injection. This could lead to unauthorized memcached commands being executed by the server.

CWE-93Improper Neutralization of CRLF Sequences (CRLF Injection) (opens in a new tab)
Base weaknessOWASP Top 10 A05:2025: Injection (opens in a new tab)
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Implementation
Avoid using CRLF as a special sequence.
Implementation
Appropriately filter or quote CRLF sequences in user-controlled input.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
Injection Prevention (opens in a new tab)
SQL Injection Prevention (opens in a new tab)
Injection Prevention in Java (opens in a new tab)
OWASP ASVS 4.0.3
V1.5.1 (opens in a new tab)
Attack patterns
Command Delimiters (opens in a new tab)
Web Server Logs Tampering (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 1 Nov 2026, 13:02 UTC

WeaknessesCWE-93

Technical details

References

Community reviews

Related threats