CVE-2026-13575
2026-11-01
10h46 +00:00
10h46 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI
HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers. With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.CVE 解决方案
Upgrade to http-session 0.54 or later.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Improper Neutralization of CRLF Sequences The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. |
