CVE-2026-46741

Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that the git repository contains an unreleased version with the gauge and set methods that also do not check for potential metric injections.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.cve.org/CVERecord?id=CVE-2026-46719	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-46720	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sanbeg:etsy\:\:statsd:*:*:*:*:*:perl:*:*

History

19 Jun 2026, 16:16

Type	Values Removed	Values Added
CWE		CWE-150

08 Jun 2026, 16:33

Type	Values Removed	Values Added
References	~~() https://www.cve.org/CVERecord?id=CVE-2026-46719 -~~	() https://www.cve.org/CVERecord?id=CVE-2026-46719 - Third Party Advisory
References	~~() https://www.cve.org/CVERecord?id=CVE-2026-46720 -~~	() https://www.cve.org/CVERecord?id=CVE-2026-46720 - Third Party Advisory
CPE		cpe:2.3:a:sanbeg:etsy\:\:statsd::::::perl::*
First Time		Sanbeg etsy\ Sanbeg

04 Jun 2026, 19:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

04 Jun 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-04 17:16

Updated : 2026-06-19 16:16

NVD link : CVE-2026-46741

Mitre link : CVE-2026-46741

CVE.ORG link : CVE-2026-46741

JSON object : View

Products Affected

sanbeg

etsy\

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

{"id": "CVE-2026-46741", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46741", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T17:40:21.895127Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/sanbeg/Etsy-Statsd", "vendor": "SANBEG", "product": "Etsy::StatsD", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.002002"}], "packageName": "Etsy-StatsD", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Etsy::StatsD::timing"}, {"name": "Etsy::StatsD::update"}, {"name": "Etsy::StatsD::send"}]}]}], "published": "2026-06-04T17:16:32.790", "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46720", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-150"}]}], "descriptions": [{"lang": "en", "value": "Etsy::StatsD versions through 1.002002 for Perl allow metric injections.\n\nThe metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that the git repository contains an unreleased version with the gauge and set methods that also do not check for potential metric injections."}], "lastModified": "2026-06-19T16:16:32.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sanbeg:etsy\\:\\:statsd:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "BA60C24A-4BF1-499C-B029-06F93652B8EA", "versionEndIncluding": "1.002002"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}