CVE-2026-46739

Net::Statsd versions before 0.13 for Perl allow metric injections. The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/cosimo/perl5-net-statsd/pull/10	Issue Tracking Patch
https://www.cve.org/CVERecord?id=CVE-2026-46719	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-46720	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cosimo:net\:\:statsd:*:*:*:*:*:perl:*:*

History

19 Jun 2026, 16:16

Type	Values Removed	Values Added
CWE		CWE-150

08 Jun 2026, 16:31

Type	Values Removed	Values Added
References	~~() https://github.com/cosimo/perl5-net-statsd/pull/10 -~~	() https://github.com/cosimo/perl5-net-statsd/pull/10 - Issue Tracking, Patch
References	~~() https://www.cve.org/CVERecord?id=CVE-2026-46719 -~~	() https://www.cve.org/CVERecord?id=CVE-2026-46719 - Third Party Advisory
References	~~() https://www.cve.org/CVERecord?id=CVE-2026-46720 -~~	() https://www.cve.org/CVERecord?id=CVE-2026-46720 - Third Party Advisory
First Time		Cosimo Cosimo net\
CPE		cpe:2.3:a:cosimo:net\:\:statsd::::::perl::*

04 Jun 2026, 19:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3

04 Jun 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-04 17:16

Updated : 2026-06-19 16:16

NVD link : CVE-2026-46739

Mitre link : CVE-2026-46739

CVE.ORG link : CVE-2026-46739

JSON object : View

Products Affected

cosimo

net\

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

{"id": "CVE-2026-46739", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46739", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T17:47:54.945242Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/cosimo/perl5-net-statsd", "vendor": "COSIMO", "product": "Net::Statsd", "versions": [{"status": "affected", "version": "0", "lessThan": "0.13", "versionType": "custom"}], "packageName": "Net-Statsd", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::Statsd::send"}, {"name": "Net::Statsd::timing"}, {"name": "Net::Statsd::update_stats"}, {"name": "Net::Statsd::gauge"}]}]}], "published": "2026-06-04T17:16:32.663", "references": [{"url": "https://github.com/cosimo/perl5-net-statsd/pull/10", "tags": ["Issue Tracking", "Patch"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46720", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-150"}]}], "descriptions": [{"lang": "en", "value": "Net::Statsd versions before 0.13 for Perl allow metric injections.\n\nThe metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nThe update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection)."}], "lastModified": "2026-06-19T16:16:32.627", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cosimo:net\\:\\:statsd:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "530E700D-A8D0-486B-A17E-2D92BDD3F5FF", "versionEndExcluding": "0.13"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}