CVE-2011-10042

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2011-10042", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-06-10T18:42:05.115Z", "datePublished": "2026-11-14T13:55:58.977Z", "dateUpdated": "2026-11-14T13:55:58.977Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Session"], "packageName": "http-session", "packageURL": "pkg:cpan/http-session", "programFiles": ["lib/HTTP/Session/Store/Memcached.pm"], "programRoutines": [{"name": "HTTP::Session::Store::Memcached::select"}, {"name": "HTTP::Session::Store::Memcached::insert"}, {"name": "HTTP::Session::Store::Memcached::update"}, {"name": "HTTP::Session::Store::Memcached::delete"}], "repo": "https://github.com/tokuhirom/http-session", "versions": [{"lessThan": "0.43", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Masahiro Nagano (kazeburo)"}], "descriptions": [{"lang": "en", "value": "HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.\n\nThe session id from the client's cookie reaches memcached unchanged as the cache key.\n\nA CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-11-14T13:55:58.977Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/tokuhirom/http-session/commit/039345db9bc9311868019fde67b89c355114a3d3.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/TOKUHIROM/HTTP-Session-0.42/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to HTTP::Session 0.43 or later.\n\nNote that HTTP::Session 0.54 includes additional security fixes, but has been marked as deprecated. Users should migrate to an alternative such as Plack::Middleware::Session."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2011-02-20T00:00:00.000Z", "value": "HTTP::Session version 0.42 released."}, {"lang": "en", "time": "2011-02-20T00:00:00.000Z", "value": "HTTP::Session version 0.43 released with improved protections against memcached injection"}, {"lang": "en", "time": "2026-06-27T00:00:00.000Z", "value": "HTTP::Session version 0.54 released, with the distribution marked as deprecated."}], "title": "HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Session"], "packageName": "http-session", "packageURL": "pkg:cpan/http-session", "programFiles": ["lib/HTTP/Session/Store/Memcached.pm"], "programRoutines": [{"name": "HTTP::Session::Store::Memcached::select"}, {"name": "HTTP::Session::Store::Memcached::insert"}, {"name": "HTTP::Session::Store::Memcached::update"}, {"name": "HTTP::Session::Store::Memcached::delete"}], "repo": "https://github.com/tokuhirom/http-session", "versions": [{"lessThan": "0.43", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.\n\nThe session id from the client's cookie reaches memcached unchanged as the cache key.\n\nA CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands."}], "id": "CVE-2011-10042", "lastModified": "2026-11-14T14:17:21.480", "metrics": {}, "published": "2026-11-14T14:17:21.480", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/tokuhirom/http-session/commit/039345db9bc9311868019fde67b89c355114a3d3.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/TOKUHIROM/HTTP-Session-0.42/changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.43)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 98.0, "source": "matching"}]}, "product": "http::session2", "vendor": "tokuhirom"}], "created": "2026-11-14T16:00:08.369846+00:00", "updated": "2026-11-14T16:00:08.369871+00:00", "vendors": ["tokuhirom", "tokuhirom$PRODUCT$http::session2"]}