HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.
The session id from the client's cookie reaches memcached unchanged as the cache key.
A CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub