CVE-2026-13575: memcached injection via Perl sessions
The oss-sec advisory published on November 1, 2026, reports that HTTP::Session versions before 0.54 allow memcached command injection through unfiltered session IDs.
By Wendelmaques Pereira · Updated today
Source: CVE-2026-13575: injeção de comandos memcached no HTTP::Session para Perl (seclists.org). Text prepared with AI from this source.
What happened and what to do
The oss-sec advisory describes CVE-2026-13575 in HTTP::Session for Perl. It states that versions before 0.54 allow memcached command injection when unfiltered session IDs are used. The publication date is November 1, 2026.
A company using this library can identify affected versions across its services, upgrade to 0.54 or later, and review how session IDs are validated before reaching memcached. It can also monitor dependencies and alert on vulnerable versions and suspicious cache-access patterns.
How the consultancy can help
Wendelmaques can diagnose exposure across applications and dependencies, scope an upgrade and session-validation effort, and implement ongoing monitoring and operation of the controls.
Next step
Send a short description of the application and its use of HTTP::Session to receive a scoped proposal.
Let's assess your project
I reply with scope and a proposal.