CVE-2026-13575

{"id": "CVE-2026-13575", "cveTags": [], "metrics": {}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/tokuhirom/http-session", "modules": ["HTTP::Session"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.54", "versionType": "custom"}], "packageURL": "pkg:cpan/http-session", "packageName": "http-session", "programFiles": ["lib/HTTP/Session/Store/CHI.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "HTTP::Session::Store::CHI::select"}, {"name": "HTTP::Session::Store::CHI::insert"}, {"name": "HTTP::Session::Store::CHI::update"}, {"name": "HTTP::Session::Store::CHI::delete"}]}]}], "published": "2026-11-01T11:18:58.040", "references": [{"url": "https://github.com/tokuhirom/http-session/commit/58288cbf941da6d2aad4ff5c0c79e523d9e583b4.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/Store/CHI.pm", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/TOKUHIROM/http-session-0.54/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/11/01/2", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-93"}]}], "descriptions": [{"lang": "en", "value": "HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.\n\nThe session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.\n\nWith a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands."}], "lastModified": "2026-11-02T19:35:33.347", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}