# CVE-2026-13575: CVE-2026-13575

Status: published. Published: 2026-11-01. Updated: 2026-11-01.

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.

The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.

With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-93

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/tokuhirom/http-session/commit/58288cbf941da6d2aad4ff5c0c79e523d9e583b4.patch (9b29abf9-4ab0-4765-b253-1875cd9b441e)

- https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/Store/CHI.pm (9b29abf9-4ab0-4765-b253-1875cd9b441e)

- https://metacpan.org/release/TOKUHIROM/http-session-0.54/changes (9b29abf9-4ab0-4765-b253-1875cd9b441e)

- http://www.openwall.com/lists/oss-security/2026/11/01/2 (af854a3a-2127-422b-91ae-364da2661108)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-13575; retrieved 2026-11-02; source updated 2026-11-01

Revision: 9f58d422208d750abf54cb64e56e1e80b8f60f2c1997970642110b43d79c20c7

Canonical: https://y2.dev/cve/CVE-2026-13575