CVE-2011-10042

not scored yet · published 2026-11-14

HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached. The session id from the client's cookie reaches memcached unchanged as the cache key. A CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

Weakness: CWE-93

Source: NVD CVE-2011-10042

References

• https://github.com/tokuhirom/http-session/commit/039345db9bc9311868019fde67b89c355114a3d3.patch
• https://metacpan.org/release/TOKUHIROM/HTTP-Session-0.42/changes

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.