Zero Radar
← feed
HighVulnerabilityCVE-2026-13575updated 1 Nov 2026, 20:26 UTC

Perl HTTP::Session lets attackers inject commands into memcached

A website's login session handling can be tricked by a specially crafted cookie into sending extra instructions to its cache server. This can let an attacker run commands the site never intended.

Fixed in HTTP::Session 0.54 or later · out Official, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesHTTP::Session 0.54 or later · since 1 Nov 2026,
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts cookieSession ID contains CR and LF characters
  2. 2Request sent to siteCookie reaches the session handler unchanged
  3. 3CHI store builds cache keyNo filtering or escaping of the session ID
  4. 4Memcached reads extra commandsBytes after CR/LF run as new commands
  5. ResultAttacker sends commands to cache server

What happened

HTTP::Session versions before 0.54 pass unfiltered session IDs from client cookies to the CHI session store. With a memcached driver, CR and LF characters in the ID end the cache command early, and the server reads the following bytes as new commands.

Why it is dangerous: Sites that store Perl sessions in CHI with memcached can have their cache server manipulated by anyone who can send a request with a crafted cookie. The sibling Memcached store already filters these characters, so the risk is specific to the CHI store.

Are you affected?

You are affected if you run HTTP::Session before 0.54 and use HTTP::Session::Store::CHI with a memcached driver.

HTTP::Session (Perl, CPAN distribution http-session) before 0.54, using HTTP::Session::Store::CHI with a memcached driver

What to do

  1. Update HTTP::Session to version 0.54 or later
  2. Check whether any application uses HTTP::Session::Store::CHI with a memcached driver
  3. Review memcached logs for unexpected commands if you use that setup

Timeline

  1. 1 Nov 2026, 11:18 UTC
    Publicly disclosed
  2. 1 Nov 2026, 17:55 UTC
    Reported by oss-security · oss-security
  3. 1 Nov 2026, 18:01 UTC
    Picked up by Zero Radar
  4. 1 Nov 2026, 20:26 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-13575
Disclosed
1 Nov 2026, 11:18 UTC
On Zero Radar
1 Nov 2026, 18:01 UTC (7 h after disclosure)
Last change
1 Nov 2026, 20:26 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Perl HTTP::Session lets attackers inject commands into memcached · Zero Radar