Description
HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.
References (4)
Core 4
Core References
Patch patch
https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patch
Release Notes release-notes
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes
Various Sources related
https://metacpan.org/pod/Cache::Memcached::Fast::Safe
Scores
CVSS v3
6.5
EPSS
0.0002
EPSS Percentile
5.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-20
Status
published
Products (1)
tokuhirom/http\
< 1.09
Published
Feb 27, 2026
Tracked Since
Feb 28, 2026