CVE-2026-8722CWE-150CWE-93

Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections

Medium · published June 3, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections.

The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00307 · 22.3th percentile
Weaknesses
CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences; CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-06-03T23:45Z
EPSS history
Timeline
  • 03 JUN 23:45Z
    Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections
    cvelistv5