CVE-2026-46720CWE-150CWE-93

Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections

High · published May 17, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
34.9
In the wild
Unconfirmed
What it is

Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.

The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00416 · 34.9th percentile
Weaknesses
CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences; CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-05-17T17:51Z
EPSS history
Timeline
  • 17 MAY 17:51Z
    Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections
    cvelistv5