CVE-2026-13575

Elevated risk· EPSS 61%

Published: 01/11/2026(UTC)Updated: 02/11/2026(UTC)Translated: 01/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.93%

61th percentile - higher than 61% of all known CVEs

Summary

In Perl HTTP::Session versions before 0.54, the client cookie session id reaches the CHI store unfiltered, allowing memcached command injection. CR and LF characters in the session id terminate the cache command early, and the server reads the following bytes as further commands.

Risk Assessment

An attacker could inject arbitrary commands into memcached, potentially manipulating session data or performing unauthorized cache operations.

Recommendation

Update HTTP::Session to version 0.54 or later and consider validating session ids at the application level.

Other vulnerabilities in HTTP::Session

CVE-2026-3256Critical
The HTTP::Session library for Perl versions before 0.54 defaults to generating insecure session IDs. It uses SHA-1 seeded with the rand function, epoch time, and PID, which is predictable.

Original NVD description (English source)

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers. With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS