CVE-2011-10042
HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached
Description
HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached. The session id from the client's cookie reaches memcached unchanged as the cache key. A CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
Key facts
- Published
- 14 Nov 2026
- Last changed
- 14 Nov 2026
- Assigned by
- CPANSec
- EPSS
- 0.923% likely to be exploited in the next 30 days, higher than 60.942% of CVEs (scores for 15 Nov 2026)
What to do
- Upgrade to HTTP::Session 0.43 or later. Note that HTTP::Session 0.54 includes additional security fixes, but has been marked as deprecated. Users should migrate to an alternative such as Plack::Middleware::Session.CNA solution statement
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Timeline
- 20 Feb 2011 HTTP::Session version 0.42 released.
- 20 Feb 2011 HTTP::Session version 0.43 released with improved protections against memcached injection
- 27 Jun 2026 HTTP::Session version 0.54 released, with the distribution marked as deprecated.
- 14 Nov 2026 Published