CVE-2026-8722

Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections. The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.cve.org/CVERecord?id=CVE-2026-46719	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-46720	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:team:net\:\:async\:\:statsd\:\:client:*:*:*:*:*:perl:*:*

History

19 Jun 2026, 16:16

Type	Values Removed	Values Added
CWE		CWE-150

08 Jun 2026, 16:39

Type	Values Removed	Values Added
References	~~() https://www.cve.org/CVERecord?id=CVE-2026-46719 -~~	() https://www.cve.org/CVERecord?id=CVE-2026-46719 - Third Party Advisory
References	~~() https://www.cve.org/CVERecord?id=CVE-2026-46720 -~~	() https://www.cve.org/CVERecord?id=CVE-2026-46720 - Third Party Advisory
CPE		cpe:2.3:a:team:net\:\:async\:\:statsd\:\:client::::::perl::*
First Time		Team Team net\

04 Jun 2026, 20:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5

04 Jun 2026, 00:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-04 00:17

Updated : 2026-06-19 16:16

NVD link : CVE-2026-8722

Mitre link : CVE-2026-8722

CVE.ORG link : CVE-2026-8722

JSON object : View

Products Affected

team

net\

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

{"id": "CVE-2026-8722", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8722", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T18:30:45.633771Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/team-at-cpan/Net-Async-Statsd", "vendor": "TEAM", "product": "Net::Async::Statsd::Client", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.005"}], "packageName": "Net-Async-Statsd", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::Async::Statsd::Client::queue_stat"}]}]}], "published": "2026-06-04T00:17:00.333", "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46720", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-150"}]}], "descriptions": [{"lang": "en", "value": "Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections.\n\nThe metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics."}], "lastModified": "2026-06-19T16:16:33.487", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:team:net\\:\\:async\\:\\:statsd\\:\\:client:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "3954F50E-7BAF-4F69-BE79-4650526D07ED", "versionEndIncluding": "0.005"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}