Description
HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.

The session id from the client's cookie reaches memcached unchanged as the cache key.

A CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
Published: 2026-11-14
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade to HTTP::Session 0.43 or later. Note that HTTP::Session 0.54 includes additional security fixes, but has been marked as deprecated. Users should migrate to an alternative such as Plack::Middleware::Session.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 14 Nov 2026 14:15:00 +0000

Type Values Removed Values Added
Description HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached. The session id from the client's cookie reaches memcached unchanged as the cache key. A CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
Title HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached
Weaknesses CWE-93
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-11-14T13:55:58.977Z

Reserved: 2026-06-10T18:42:05.115Z

Link: CVE-2011-10042

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-14T14:17:21.480

Modified: 2026-11-14T14:17:21.480

Link: CVE-2011-10042

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-93

    Improper Neutralization of CRLF Sequences ('CRLF Injection')