CVE-2026-13575 HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters,...

CVE-2026-13575

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters,...

CVE-2026-13575 HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters,...

CVE-2026-13575

The HTTP::Session module for Perl (versions before 0.54 ) is vulnerable to memcached command injection via unfiltered session IDs in the HTTP::Session::Store::CHI component. The root cause is that the CHI store fails to validate or escape session IDs provided by client cookies, unlike its sibling...

PT-2026-134896

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters,...

CVE-2026-13575: CRLF Injection

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters,...

Vulnerability fixed in Zimbra Collaboration

Zimbra has fixed a vulnerability in Zimbra Collaboration. The vulnerability allows a remote malicious person to inject memcached commands and thereby manipulate cached data manipulate. This makes it possible to manipulate content that is served to users of Zimbra Collaboration. Thus functionaliti...