Perl HTTP::Session Memcached Command Injection via Session ID Validation Failure (CVE-2026-13575)
Executive & SecOps Summary
SECOPS ASSESSMENTPerl applications using HTTP::Session versions before 0.54 with the HTTP::Session::Store::CHI backend
Unauthenticated attackers can inject arbitrary Memcached commands via crafted session IDs, leading to session hijacking, data tampering, or cache poisoning
Upgrade HTTP::Session to version 0.54 or higher, or implement strict input validation to reject control characters in session cookies
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade the HTTP::Session module to the latest secure version (0.54 or higher) using CPAN or cpanm.
# Upgrade HTTP::Session using cpanm
cpanm HTTP::Session
# Or install the patched version explicitly
cpanm TOKUHIROM/HTTP-Session-0.54.tar.gz2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, implement a middleware-level filter to intercept and reject any session cookies containing CR/LF characters.
# Example PSGI middleware workaround to sanitize session cookies
use Plack::Request;
my $app = sub {
my $env = shift;
my $req = Plack::Request->new($env);
my $cookie_name = 'http_session_id'; # Replace with your actual session cookie name
my $sid = $req->cookies->{$cookie_name};
if ($sid && $sid =~ /[\r\
]/) {
# Reject requests containing CR/LF in the session ID
return [400, ['Content-Type' => 'text/plain'], ['Bad Request: Invalid Session ID']];
}
# Proceed with normal application flow
...
};3. Log Audit & IoC Verification Commands
Verify the installed version of HTTP::Session and inspect web server logs for potential injection attempts.
# Check the currently installed HTTP::Session version
perl -MHTTP::Session -e 'print $HTTP::Session::VERSION . "\
"'
# Scan web server access logs for CR/LF injection patterns (%0D, %0A) in cookies
grep -Ei 'cookie.*(%0d|%0a|\x0d|\x0a)' /var/log/nginx/access.logScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the Perl HTTP::Session module when configured to use the HTTP::Session::Store::CHI storage engine. The session ID supplied by the client's HTTP cookie is passed directly to the underlying CHI cache store without any sanitization or validation. While the sibling HTTP::Session::Store::Memcached engine explicitly rejects session IDs containing control characters, the CHI store lacks this validation, and the CHI library itself does not escape keys when communicating with its Memcached drivers.
2. Exploitation Mechanics & Attack Scenario
Memcached uses a simple text-based protocol where Carriage Return (CR, \r) and Line Feed (LF, \ ) characters act as command delimiters. An attacker can craft a malicious session cookie containing these control characters. When HTTP::Session::Store::CHI queries Memcached using the unsanitized session ID as a key, the injected CR/LF characters terminate the initial retrieval command prematurely. The Memcached server then interprets the subsequent bytes in the payload as new, independent commands (such as set to overwrite session data or delete to destroy sessions).
3. Infrastructure & Business Impact
Successful exploitation allows remote, unauthenticated attackers to manipulate or hijack active user sessions. This can lead to unauthorized privilege escalation, account takeover, and data leakage. Furthermore, cache poisoning attacks can disrupt application state consistency, leading to severe business logic failures and service degradation.
Official Vendor Advisories & References
HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers. With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
Frequently Asked SecOps Questions (CVE-2026-13575)
FAQQ1. How critical is CVE-2026-13575 and is it actively exploited in the wild?
CVE-2026-13575 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 0.9%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-13575?
Primary impacted vendors include tokuhirom, ktat across http::session, chi. Scope summary: HTTP::Session versions prior to 0.54, specifically when integrated with HTTP::Session::Store::CHI and a Memcached driver.
Q3. What temporary mitigations or workarounds exist for CVE-2026-13575 before patching?
[Mitigation] Upgrade HTTP::Session to version 0.54 or higher, or implement strict input validation to reject control characters in session cookies Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-13575
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (tokuhirom)
View Category →GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
JFrog Artifactory Authentication Bypass and Administrative Privilege Escalation (CVE-2026-82329)
[Affected Scope] JFrog Artifactory Self-Managed instances running under default configurations
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.