CVE-2026-46719

Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections. The metric names were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/robrwo/Net-Statsd-Lite/commit/e1a8ab866d75c2827982134e9cf7e51a7f771153.patch
https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.9.0/changes
http://www.openwall.com/lists/oss-security/2026/05/16/9

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Net::Statsd::Lite anteriores a la 0.9.0 para Perl permitían inyecciones de métricas. Los nombres de las métricas no se verificaban en busca de saltos de línea, dos puntos o barras verticales. Las métricas generadas a partir de fuentes no confiables podrían inyectar métricas statsd adicionales.

Information

Published : 2026-05-16 14:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-46719

Mitre link : CVE-2026-46719

CVE.ORG link : CVE-2026-46719

JSON object : View

Products Affected

No product.

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

{"id": "CVE-2026-46719", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46719", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T12:51:17.582054Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/robrwo/Net-Statsd-Lite", "vendor": "RRWO", "product": "Net::Statsd::Lite", "versions": [{"status": "affected", "version": "0", "lessThan": "0.9.0", "versionType": "custom"}], "packageName": "Net-Statsd-Lite", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::Statsd::Lite::record_metric"}]}]}], "published": "2026-05-16T14:16:37.507", "references": [{"url": "https://github.com/robrwo/Net-Statsd-Lite/commit/e1a8ab866d75c2827982134e9cf7e51a7f771153.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.9.0/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/16/9", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-150"}]}], "descriptions": [{"lang": "en", "value": "Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections.\n\nThe metric names were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics."}, {"lang": "es", "value": "Las versiones de Net::Statsd::Lite anteriores a la 0.9.0 para Perl permit\u00edan inyecciones de m\u00e9tricas.\n\nLos nombres de las m\u00e9tricas no se verificaban en busca de saltos de l\u00ednea, dos puntos o barras verticales. Las m\u00e9tricas generadas a partir de fuentes no confiables podr\u00edan inyectar m\u00e9tricas statsd adicionales."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}