CVE-2011-10042
Received Received - Intake

Memcached Command Injection in HTTP::Session for Perl

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: CPANSec

Description
HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached. The session id from the client's cookie reaches memcached unchanged as the cache key. A CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2011-10042
EUVD
EUVD-2011-5273

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tokuhirom http_session to 0.43 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memcached command injection flaw in HTTP::Session versions before 0.43 for Perl. It occurs because session IDs from client cookies are sent directly to memcached without filtering. Attackers can inject CR and LF characters into session IDs to terminate cache commands prematurely and send additional malicious commands to the memcached server.

Detection Guidance

Check Perl applications using HTTP::Session::Store::Memcached for session IDs containing CR, LF, or null bytes. Inspect memcached logs for unusual commands or errors. Test with malformed session IDs to see if they bypass validation.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the memcached server by manipulating session IDs. This could lead to unauthorized data access, modification, or deletion in the cache, potentially compromising the integrity and confidentiality of session data and other stored information.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR or HIPAA if session IDs containing malicious payloads are used to inject commands into Memcached. Unauthorized access or data manipulation via session ID manipulation may lead to breaches of confidentiality or integrity requirements under these regulations.

Mitigation Strategies

Update HTTP::Session to version 0.43 or later. Implement input validation for session IDs to filter CR, LF, null bytes, and excessive length. Review memcached server logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2011-10042. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...