{"id":"CVE-2011-10042","kind":"vulnerability","aliases":["CVE-2011-10042"],"related":[],"title":"HTTP::Session: unfiltered session ids let attackers inject memcached commands","description":"HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.\n\nThe session id from the client's cookie reaches memcached unchanged as the cache key.\n\nA CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.","summary":"HTTP::Session before 0.43 for Perl passes the session id from a client's cookie straight to memcached as a cache key. A carriage return and line feed in that id end the memcached command early, so the bytes after them run as extra memcached commands.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-session","memcached","package","perl"],"not_affected_if":["no-memcached","other-session-store"],"how_to_check":"- Find the installed version of HTTP::Session with `perl -MHTTP::Session -e 'print $HTTP::Session::VERSION'`\n- Check whether the app uses HTTP::Session::Store::Memcached as its session store","fix":"- HTTP::Session `0.43` or later (from the linked patch; the sources give no further detail)","status":"open","published_at":"2026-11-14T14:17:21+00:00","first_seen_at":"2026-11-14T14:29:07+00:00","triaged_at":"2026-11-14T14:31:19+00:00","updated_at":"2026-11-14T14:31:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-14T14:31:19Z","model":"claude-haiku-5-5","output":{"fix":"- HTTP::Session `0.43` or later (from the linked patch; the sources give no further detail)","reach":"internet","title":"HTTP::Session: unfiltered session ids let attackers inject memcached commands","impact":"medium","summary":"HTTP::Session before 0.43 for Perl passes the session id from a client's cookie straight to memcached as a cache key. A carriage return and line feed in that id end the memcached command early, so the bytes after them run as extra memcached commands.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","http-session","memcached"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker sends extra memcached commands through the session cookie","analyst_note":"Confirm the fixed version and whether the patch is in a tagged release; check the NVD page for CVSS and affected version ranges.","how_to_check":"- Find the installed version of HTTP::Session with `perl -MHTTP::Session -e 'print $HTTP::Session::VERSION'`\n- Check whether the app uses HTTP::Session::Store::Memcached as its session store\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-session-store","no-memcached"],"who_is_affected":"Applications that use HTTP::Session with the Memcached session store and take session ids from client cookies are exposed. Apps using other session stores, or no Memcached store, are not affected by this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00073,"input_tokens":4570,"output_tokens":546,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-10042':13A,16A '-2011':12A,15A '0.43':26B,73C 'allow':76C 'attack':7A 'byte':61B,122C 'cach':43B,102C,114C 'carriag':46B 'client':35B,94C 'command':10A,57B,68B,78C,115C,127C 'cooki':37B,96C 'cr':105C 'cve':11A,14A 'earli':58B,116C 'end':54B,112C 'extra':66B 'feed':50B 'http':1A,18B,23B,69C,85C 'http-session':17B 'id':5A,32B,53B,83C,91C,111C 'inject':8A,79C 'key':44B,103C 'let':6A 'lf':107C 'line':49B 'memcach':9A,20B,40B,56B,67B,77C,88C,98C 'packag':21B 'pass':29B 'perl':22B,28B,75C 'reach':97C 'read':120C 'return':47B 'run':64B 'server':119C 'session':2A,4A,19B,24B,31B,70C,82C,86C,90C,110C 'store':87C 'straight':38B 'unchang':99C 'unfilt':3A,81C 'version':71C 'via':80C","nicknames":[],"mitigations":[],"who_affected":"Applications that use HTTP::Session with the Memcached session store and take session ids from client cookies are exposed. Apps using other session stores, or no Memcached store, are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["httpsession","memcached","package","perl","unknown"],"campaign_type":null,"search_a":"'-10042':13A,16A '-2011':12A,15A 'attack':7A 'command':10A 'cve':11A,14A 'http':1A 'id':5A 'inject':8A 'let':6A 'memcach':9A 'session':2A,4A 'unfilt':3A","search_b":"'0.43':26B 'byte':61B 'cach':43B 'carriag':46B 'client':35B 'command':57B,68B 'cooki':37B 'earli':58B 'end':54B 'extra':66B 'feed':50B 'http':18B,23B 'http-session':17B 'id':32B,53B 'key':44B 'line':49B 'memcach':20B,40B,56B,67B 'packag':21B 'pass':29B 'perl':22B,28B 'return':47B 'run':64B 'session':19B,24B,31B 'straight':38B","search_c":"'0.43':73C 'allow':76C 'byte':122C 'cach':102C,114C 'client':94C 'command':78C,115C,127C 'cooki':96C 'cr':105C 'earli':116C 'end':112C 'http':69C,85C 'id':83C,91C,111C 'inject':79C 'key':103C 'lf':107C 'memcach':77C,88C,98C 'perl':75C 'reach':97C 'read':120C 'server':119C 'session':70C,82C,86C,90C,110C 'store':87C 'unchang':99C 'unfilt':81C 'version':71C 'via':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T14:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2011-10042","url":"https://nvd.nist.gov/vuln/detail/CVE-2011-10042","severity":null,"published_at":"2026-11-14T14:17:21+00:00","modified_at":"2026-11-14T14:17:21+00:00","first_seen_at":"2026-11-14T14:29:07+00:00","fetched_at":"2026-11-14T14:29:07+00:00","note":null}],"documents":[{"id":156209,"url":"https://github.com/tokuhirom/http-session/commit/039345db9bc9311868019fde67b89c355114a3d3.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}