CVE-2026-46720

HIGH8.2

Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections

Published May 17, 2026

Modified 5 days ago

Details

Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.

The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

References

FIX

https://github.com/robrwo/Net-Statsd-Tiny/commit/06f814f52fbcc0b2afddf7a2d6f8137fd3cede13.patch

WEB

https://metacpan.org/release/RRWO/Net-Statsd-Tiny-v0.3.8/changes

WEB

https://www.cve.org/CVERecord?id=CVE-2026-46719

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-46720

CVSS Analysis

CVSS v3.1

8.2

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

HighI:H

Availability

NoneA:N

8.2/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness Type (CWE)

Other

CWE-150

CWE-93

Ecosystems

Timeline

PublishedMay 17, 2026

ModifiedJun 19, 2026

CVE-2026-46720 | Mondoo Vulnerability Intelligence