# CVE-2026-13575: HTTP::Session memcached command injection in Store::CHI

Source: https://junglewise.ai/threats/cve-2026-13575-http-session-versions-before-0-54-for-perl-allow-memcached  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-13575 · Severity: info · Published 2026-11-01

HTTP::Session is a Perl library that manages user sessions in web applications, often using memcached for storage. A vulnerability in the CHI storage backend allows attackers to inject memcached commands by crafting malicious session IDs, potentially reading or modifying cached data that other users depend on. This could lead to session hijacking, data theft, or disruption of application functionality.

Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-13575 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13575 being exploited in the wild.

**How severe is CVE-2026-13575?** Informational severity, published 1 November 2026.

**Which products and versions are affected?** Perl HTTP::Session before 0.54.

**Is there a fix for CVE-2026-13575?** Yes: fixed in HTTP::Session 0.54. Until then: Do not use HTTP::Session::Store::CHI with memcached-backed CHI drivers until upgrading. Use HTTP::Session::Store::Memcached instead, which already includes proper session ID filtering, or switch CHI to a non-memcached backend (e.g., in-memory or file-based). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13575 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13575?** Check whether you run Perl HTTP::Session at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in HTTP::Session 0.54

Do not use HTTP::Session::Store::CHI with memcached-backed CHI drivers until upgrading. Use HTTP::Session::Store::Memcached instead, which already includes proper session ID filtering, or switch CHI to a non-memcached backend (e.g., in-memory or file-based).

## Technical details

The vulnerability is a memcached command injection in HTTP::Session::Store::CHI: session IDs from client cookies are passed directly to the CHI cache layer without validation, whereas the sibling Memcached store filters control characters. When CHI uses a memcached driver as backend, CR and LF bytes in the session ID terminate the current command prematurely, allowing an attacker to inject arbitrary commands. A network attacker can craft a malicious session ID in an HTTP cookie to trigger this.

## Affected products

- Perl HTTP::Session before 0.54

## Timeline

- 2026-11-01: disclosed: Vulnerability published

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/tokuhirom/http-session/commit/58288cbf941da6d2aad4ff5c0c79e523d9e583b4.patch](https://github.com/tokuhirom/http-session/commit/58288cbf941da6d2aad4ff5c0c79e523d9e583b4.patch)