CVE-2026-13575: HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI

As cited

Copy frozen at 2026-11-01 20:46 UTC (site build).

vulnerabilities

CVE-2026-13575: HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI

CVE-2026-13575 affects HTTP::Session versions before 0.54 for Perl, allowing memcached command injection through unfiltered session identifiers in the HTTP::Session::Store::CHI module. The vulnerability enables attackers to inject arbitrary memcached commands via crafted session IDs.

Why it matters: Perl developers and administrators using HTTP::Session with memcached backends must upgrade to version 0.54 or later to prevent session manipulation and potential cache poisoning attacks.

Source published

2026-11-01 17:55 UTC

First seen by Cybersecurity Tracker

2026-11-01 20:00 UTC