CVE-2011-10042: HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached

Published Nov 14, 2026

Updated

HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.

The session id from the client's cookie reaches memcached unchanged as the cache key.

A CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.43
Compensating control
Migrate to an alternative session middleware such as Plack::Middleware::Session.

Event History

Nov 14, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·02:17 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using HTTP::Session before version 0.43 with HTTP::Session::Store::Memcached are exposed, because client-supplied session IDs are used unchanged as memcached cache keys.

What does an attacker need to exploit this issue?

An attacker needs to supply a session ID through a client cookie containing both carriage-return and line-feed characters. Those characters terminate the intended memcached command and cause subsequent bytes to be processed as additional commands.

How can I determine whether my application is affected?

Check whether the application uses HTTP::Session::Store::Memcached and whether its installed HTTP::Session version is earlier than 0.43. If both conditions apply, the application is affected.

What is the available remediation?

Upgrade HTTP::Session to version 0.43 or later, which addresses the unfiltered session-ID handling described in the affected versions.

CVE-2011-10042: HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether my application is affected?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether my application is affected?

What is the available remediation?