---
id: "CVE-2026-13575"
kind: "vulnerability"
aliases: ["CVE-2026-13575"]
title: "HTTP::Session Perl module: memcached command injection via session cookie"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["chi", "http-session", "memcached", "package", "perl"]
not_affected_if: ["no-perl", "non-memcached-store"]
published_at: "2026-11-01T11:18:58+00:00"
first_seen_at: "2026-11-01T11:49:50+00:00"
updated_at: "2026-11-01T11:50:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13575", "first_seen_at": "2026-11-01T11:49:50+00:00"}]
---

# HTTP::Session Perl module: memcached command injection via session cookie

HTTP::Session before 0.54 passes the session id from a client's cookie unchanged into the CHI cache store. With a memcached driver, line break characters in that id let an attacker send extra memcached commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the installed HTTP::Session version is below `0.54` (for example with `perl -MHTTP::Session -e 'print $HTTP::Session::VERSION'`).
- Check whether the application uses HTTP::Session::Store::CHI with a memcached driver.

## Fix

- Move HTTP::Session to `0.54` or later.

## Timeline

- 2026-11-01T11:49:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-13575

## From the sources

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.

The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.

With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_