CVE-2011-10042 · Package
NO FIX YET · SEE WHAT TO DO
HTTP::Session before 0.43 for Perl passes the session id from a client's cookie straight to memcached as a cache key. A carriage return and line feed in that id end the memcached command early, so the bytes after them run as extra memcached commands.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use HTTP::Session with the Memcached session store and take session ids from client cookies are exposed. Apps using other session stores, or no Memcached store, are not affected by this flaw.
Not affected if no-memcached, other-session-store
Who cares http-session, memcached, perl
perl -MHTTP::Session -e 'print $HTTP::Session::VERSION'0.43 or later (from the linked patch; the sources give no further detail)HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.
The session id from the client's cookie reaches memcached unchanged as the cache key.
A CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.