CPANSA-http-session-2026-13575: http-session vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-11-01T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-11-01T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | Severity | ||
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.
The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.
With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
Vulnerabilities
CVE-2026-13575
Vulnerability DescriptionHTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.
The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.
With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
| Weakness | CWE-93 : Improper Neutralization of CRLF Sequences ('CRLF Injection') |
|---|
Product status
Known affected
| Product | Score | ||||
|---|---|---|---|---|---|
| http-session less than 0.54 |
|
Fixed
- http-session greater than or equal 0.54
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-http-session-2026-13575 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-http-session-2026-13575.json - https://github.com/tokuhirom/http-session/commit/58288cbf941da6d2aad4ff5c0c79e523d9e583b4.patch external
https://github.com/tokuhirom/http-session/commit/58288cbf941da6d2aad4ff5c0c79e523d9e583b4.patch - https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/Store/CHI.pm external
https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/Store/CHI.pm - https://metacpan.org/release/TOKUHIROM/http-session-0.54/changes external
https://metacpan.org/release/TOKUHIROM/http-session-0.54/changes - CVE-2026-13575 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-13575
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Sun Nov 1 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/