CVE-2026-46719 - Vulnerability Details - OpenCVE

Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections. The metric names were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Rrwo	Net::statsd::lite

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/05/16/9
https://github.com/robrwo/Net-Statsd-Lite/commit/e1a8ab866d75c2827982134e9cf7e51a7f771153.patch
https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.9.0/changes

History

Tue, 19 May 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 17 May 2026 18:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Rrwo Rrwo net::statsd::lite
Vendors & Products		Rrwo Rrwo net::statsd::lite

Sat, 16 May 2026 21:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/05/16/9

Sat, 16 May 2026 13:45:00 +0000

Type	Values Removed	Values Added
Description		Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections. The metric names were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
Title		Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections
Weaknesses		CWE-93
References		https://github.com/robrwo/Net-Statsd-Lite/commit/e1a8ab866d75c2827982134e9cf7e51a7f771153.patch https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.9.0/changes

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2026-05-16T13:37:22.000Z

Updated: 2026-05-19T12:51:28.945Z

Reserved: 2026-05-16T00:56:00.338Z

Link: CVE-2026-46719

Vulnrichment

Updated: 2026-05-16T20:15:59.046Z

NVD

Status : Deferred

Published: 2026-05-16T14:16:37.507

Modified: 2026-05-19T14:16:47.137

Link: CVE-2026-46719

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46719", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-05-16T00:56:00.338Z", "datePublished": "2026-05-16T13:37:22.000Z", "dateUpdated": "2026-05-19T12:51:28.945Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-Statsd-Lite", "product": "Net::Statsd::Lite", "programRoutines": [{"name": "Net::Statsd::Lite::record_metric"}], "repo": "https://github.com/robrwo/Net-Statsd-Lite", "vendor": "RRWO", "versions": [{"lessThan": "0.9.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections.\n\nThe metric names were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-16T13:37:22.000Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.9.0/changes"}, {"tags": ["patch"], "url": "https://github.com/robrwo/Net-Statsd-Lite/commit/e1a8ab866d75c2827982134e9cf7e51a7f771153.patch"}], "solutions": [{"lang": "en", "value": "Upgrade to Net::Statsd::Lite version 0.9.0 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "Issue reported to CPANSec"}, {"lang": "en", "time": "2026-05-15T00:00:00.000Z", "value": "Author notified"}, {"lang": "en", "time": "2026-05-16T00:00:00.000Z", "value": "Fix released"}], "title": "Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections", "workarounds": [{"lang": "en", "value": "Apply the patch.\n\nAlternatively, validate that all metrics sent to the client based on untrusted data do not contain metric injections."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/16/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-16T20:15:59.046Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-19T12:51:17.582054Z", "id": "CVE-2026-46719", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T12:51:28.945Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/16/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-16T20:15:59.046Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-46719", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T12:51:17.582054Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T12:51:12.566Z"}}], "cna": {"title": "Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/robrwo/Net-Statsd-Lite", "vendor": "RRWO", "product": "Net::Statsd::Lite", "versions": [{"status": "affected", "version": "0", "lessThan": "0.9.0", "versionType": "custom"}], "packageName": "Net-Statsd-Lite", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::Statsd::Lite::record_metric"}]}], "timeline": [{"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "Issue reported to CPANSec"}, {"lang": "en", "time": "2026-05-15T00:00:00.000Z", "value": "Author notified"}, {"lang": "en", "time": "2026-05-16T00:00:00.000Z", "value": "Fix released"}], "solutions": [{"lang": "en", "value": "Upgrade to Net::Statsd::Lite version 0.9.0 or later."}], "references": [{"url": "https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.9.0/changes", "tags": ["release-notes"]}, {"url": "https://github.com/robrwo/Net-Statsd-Lite/commit/e1a8ab866d75c2827982134e9cf7e51a7f771153.patch", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Apply the patch.\n\nAlternatively, validate that all metrics sent to the client based on untrusted data do not contain metric injections."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections.\n\nThe metric names were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-16T13:37:22.000Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46719", "state": "PUBLISHED", "dateUpdated": "2026-05-19T12:51:28.945Z", "dateReserved": "2026-05-16T00:56:00.338Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-05-16T13:37:22.000Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}