CVE-2026-13575

The record

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers. With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

Affected packages

Related vulnerabilities

• CVE-2026-57154 OPNsense is a FreeBSD based firewall and routing platform. CWE-93
• CVE-2026-121432 AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege… CWE-93
• CVE-2026-119560 OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows… CWE-93
• CVE-2026-119424 OPNsense core before 26.7.8 contains a configuration line injection vulnerability that… CWE-93
• CVE-2026-119417 CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0… CWE-93
• CVE-2026-119415 CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that… CWE-93
• CVE-2026-115303 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF… CWE-93
• CVE-2026-118371 LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto… CWE-93