CVE-2011-10042 PUBLISHED

HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached

Assigner: CPANSec
Reserved: 10.06.2026 Published: 14.11.2026 Updated: 14.11.2026

HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.

The session id from the client's cookie reaches memcached unchanged as the cache key.

A CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

Product Status

Package Collection https://cpan.org/modules
Package Name http-session
Versions Default: unaffected
  • affected from 0 to 0.43 (excl.)

Solutions

Upgrade to HTTP::Session 0.43 or later.

Note that HTTP::Session 0.54 includes additional security fixes, but has been marked as deprecated. Users should migrate to an alternative such as Plack::Middleware::Session.

Credits

  • Masahiro Nagano (kazeburo) reporter

References

Problem Types

  • CWE-93 Improper Neutralization of CRLF Sequences CWE