CVE-2011-10042

UNKNOWN 0.0

HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached. The session id from the client's cookie reaches memcached unchanged as the cache key. A CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

CWE	CWE-93
Published	Nov 14, 2026

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new unknown vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/tokuhirom/http-session/commit/039345db9bc9311868019fde67b89c355114a3d3.patch metacpan.org: https://metacpan.org/release/TOKUHIROM/HTTP-Session-0.42/changes

Credits

🔍 Masahiro Nagano (kazeburo)