CVE-2026-46739CWE-150CWE-93

Net::Statsd versions before 0.13 for Perl allow metric injections

Medium · published June 4, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

Net::Statsd versions before 0.13 for Perl allow metric injections.

The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00401 · 33.2th percentile
Weaknesses
CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences; CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-06-04T15:45Z
EPSS history
Timeline
  • 04 JUN 15:45Z
    Net::Statsd versions before 0.13 for Perl allow metric injections
    cvelistv5