Command Injection Vulnerability in HTTP::Session by Perl Vendor

CVE-2026-13575

What is CVE-2026-13575?

The HTTP::Session module in Perl versions prior to 0.54 is susceptible to command injection via unfiltered session IDs when using the CHI cache. The underlying issue arises from the failure to sanitize session IDs, which allows for malicious inputs containing control characters to manipulate the behavior of memcached commands. Unlike other cache stores that reject such IDs, CHI lacks this critical validation, making it vulnerable to cache command injection attacks. An attacker can exploit this by crafting session IDs that include CR and LF characters, leading to the potential execution of arbitrary cache commands.

References