---
id: CVE-2026-13575
title: >-
  HTTP::Session versions before 0.54 for Perl allow memcached command injection
  via unfiltered session ids in HTTP::Session::Store::CHI
summary: >-
  HTTP::Session versions before 0.54 for Perl allow memcached command injection
  via unfiltered session ids in HTTP::Session::Store::CHI.


  The session id from the client's cookie reaches the CHI cache unchanged. The
  sibling HTTP::Session::S…
severity: none
cwe:
  - CWE-93
product: http-session
affected:
  - http-session < 0.54
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-06T15:00:56.028964Z'
published: '2026-11-01'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:01:08.985Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-13575'
references:
  - url: >-
      https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/Store/CHI.pm
  - url: >-
      https://github.com/tokuhirom/http-session/commit/58288cbf941da6d2aad4ff5c0c79e523d9e583b4.patch
  - url: 'https://metacpan.org/release/TOKUHIROM/http-session-0.54/changes'
tags:
  - cve.org
epss: 0.00933
epssPercentile: 0.60953
ingestedAt: '2026-11-05T19:30:42.605Z'
---

## Overview

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.

The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.

With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

## Affected

- `http-session < 0.54`

## Remediation

Upgrade to http-session 0.54 or later.