{"api_version":"1","generated_at":"2026-11-14T23:50:19+00:00","cve":"CVE-2011-10042","urls":{"html":"https://cve.report/CVE-2011-10042","api":"https://cve.report/api/cve/CVE-2011-10042.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-10042","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-10042"},"summary":{"title":"HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached","description":"HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.\n\nThe session id from the client's cookie reaches memcached unchanged as the cache key.\n\nA CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.","state":"PUBLISHED","assigner":"CPANSec","published_at":"2026-11-14 14:17:21","updated_at":"2026-11-14 21:16:49"},"problem_types":["CWE-93","CWE-93 CWE-93 Improper Neutralization of CRLF Sequences"],"metrics":[],"references":[{"url":"https://github.com/tokuhirom/http-session/commit/039345db9bc9311868019fde67b89c355114a3d3.patch","name":"https://github.com/tokuhirom/http-session/commit/039345db9bc9311868019fde67b89c355114a3d3.patch","refsource":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://metacpan.org/release/TOKUHIROM/HTTP-Session-0.42/changes","name":"https://metacpan.org/release/TOKUHIROM/HTTP-Session-0.42/changes","refsource":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://www.openwall.com/lists/oss-security/2026/11/14/10","name":"http://www.openwall.com/lists/oss-security/2026/11/14/10","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-10042","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-10042","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[{"source":"CNA","time":"2011-02-20T00:00:00.000Z","lang":"en","value":"HTTP::Session version 0.42 released."},{"source":"CNA","time":"2011-02-20T00:00:00.000Z","lang":"en","value":"HTTP::Session version 0.43 released with improved protections against memcached injection"},{"source":"CNA","time":"2026-06-27T00:00:00.000Z","lang":"en","value":"HTTP::Session version 0.54 released, with the distribution marked as deprecated."}],"solutions":[{"source":"CNA","title":"","value":"Upgrade to HTTP::Session 0.43 or later.\n\nNote that HTTP::Session 0.54 includes additional security fixes, but has been marked as deprecated.  Users should migrate to an alternative such as Plack::Middleware::Session.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Masahiro Nagano (kazeburo)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-11-14T21:04:51.716Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/14/10"}],"title":"CVE Program Container"}],"cna":{"affected":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["HTTP::Session"],"packageName":"http-session","packageURL":"pkg:cpan/http-session","programFiles":["lib/HTTP/Session/Store/Memcached.pm"],"programRoutines":[{"name":"HTTP::Session::Store::Memcached::select"},{"name":"HTTP::Session::Store::Memcached::insert"},{"name":"HTTP::Session::Store::Memcached::update"},{"name":"HTTP::Session::Store::Memcached::delete"}],"repo":"https://github.com/tokuhirom/http-session","versions":[{"lessThan":"0.43","status":"affected","version":"0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"reporter","value":"Masahiro Nagano (kazeburo)"}],"descriptions":[{"lang":"en","value":"HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.\n\nThe session id from the client's cookie reaches memcached unchanged as the cache key.\n\nA CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-93","description":"CWE-93 Improper Neutralization of CRLF Sequences","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-14T13:55:58.977Z","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","shortName":"CPANSec"},"references":[{"tags":["patch"],"url":"https://github.com/tokuhirom/http-session/commit/039345db9bc9311868019fde67b89c355114a3d3.patch"},{"tags":["release-notes"],"url":"https://metacpan.org/release/TOKUHIROM/HTTP-Session-0.42/changes"}],"solutions":[{"lang":"en","value":"Upgrade to HTTP::Session 0.43 or later.\n\nNote that HTTP::Session 0.54 includes additional security fixes, but has been marked as deprecated.  Users should migrate to an alternative such as Plack::Middleware::Session."}],"source":{"discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2011-02-20T00:00:00.000Z","value":"HTTP::Session version 0.42 released."},{"lang":"en","time":"2011-02-20T00:00:00.000Z","value":"HTTP::Session version 0.43 released with improved protections against memcached injection"},{"lang":"en","time":"2026-06-27T00:00:00.000Z","value":"HTTP::Session version 0.54 released, with the distribution marked as deprecated."}],"title":"HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached","x_generator":{"engine":"cpansec-cna-tool 0.1"}}},"cveMetadata":{"assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","assignerShortName":"CPANSec","cveId":"CVE-2011-10042","datePublished":"2026-11-14T13:55:58.977Z","dateReserved":"2026-06-10T18:42:05.115Z","dateUpdated":"2026-11-14T21:04:51.716Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-14 14:17:21","lastModifiedDate":"2026-11-14 21:16:49","problem_types":["CWE-93","CWE-93 CWE-93 Improper Neutralization of CRLF Sequences"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"10042","Ordinal":"1","Title":"HTTP::Session versions before 0.43 for Perl allow memcached comm","CVE":"CVE-2011-10042","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"10042","Ordinal":"1","NoteData":"HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.\n\nThe session id from the client's cookie reaches memcached unchanged as the cache key.\n\nA CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.","Type":"Description","Title":"HTTP::Session versions before 0.43 for Perl allow memcached comm"}]}}}