Vulnerability record/PUBLISHED/Published Nov 14, 2026 13:55:58 UTC
CVE-2011-10042
HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached. The session id from the client's cookie reaches memcached unchanged as the cache key. A CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityCPANSec
Last updatedNov 14, 2026 13:55:58 UTC
PublishedNov 14, 2026 13:55:58 UTC
ReservedJun 10, 2026 18:42:05 UTC
Credits
- Masahiro Nagano (kazeburo)