CVE-2026-46739

Net::Statsd versions before 0.13 for Perl allow metric injections. The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/cosimo/perl5-net-statsd/pull/10	Issue Tracking Patch
https://www.cve.org/CVERecord?id=CVE-2026-46719	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-46720	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cosimo:net\:\:statsd:*:*:*:*:*:perl:*:*

History

No history.

Information

Published : 2026-06-04 17:16

Updated : 2026-07-22 20:10

NVD link : CVE-2026-46739

Mitre link : CVE-2026-46739

CVE.ORG link : CVE-2026-46739

JSON object : View

Products Affected

cosimo

net\

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

{"id": "CVE-2026-46739", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46739", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T17:47:54.945242Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/cosimo/perl5-net-statsd", "vendor": "COSIMO", "product": "Net::Statsd", "versions": [{"status": "affected", "version": "0", "lessThan": "0.13", "versionType": "custom"}], "packageName": "Net-Statsd", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::Statsd::send"}, {"name": "Net::Statsd::timing"}, {"name": "Net::Statsd::update_stats"}, {"name": "Net::Statsd::gauge"}]}]}], "published": "2026-06-04T17:16:32.663", "references": [{"url": "https://github.com/cosimo/perl5-net-statsd/pull/10", "tags": ["Issue Tracking", "Patch"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46720", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-150"}]}], "descriptions": [{"lang": "en", "value": "Net::Statsd versions before 0.13 for Perl allow metric injections.\n\nThe metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nThe update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection)."}, {"lang": "es", "value": "Las versiones de Net::Statsd anteriores a la 0.13 para Perl permiten inyecciones de m\u00e9tricas.\n\nLos nombres de las m\u00e9tricas no se verifican en busca de saltos de l\u00ednea, dos puntos o barras verticales. Las m\u00e9tricas generadas a partir de fuentes no confiables podr\u00edan inyectar m\u00e9tricas statsd adicionales.\n\nLos m\u00e9todos update_stats (utilizado para actualizar contadores) y gauge no comprueban que los valores sean num\u00e9ricos (lo que bloquear\u00eda la inyecci\u00f3n de m\u00e9tricas)."}], "lastModified": "2026-07-22T20:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cosimo:net\\:\\:statsd:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "530E700D-A8D0-486B-A17E-2D92BDD3F5FF", "versionEndExcluding": "0.13"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}