CVE-2026-46720 - Vulnerability Details - OpenCVE

Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Rrwo	Net::statsd::tiny

No data.

No data.

References

Link	Providers
https://github.com/robrwo/Net-Statsd-Tiny/commit/06f814f52fbcc0b2afddf7a2d6f8137fd3cede13.patch
https://metacpan.org/release/RRWO/Net-Statsd-Tiny-v0.3.8/changes
https://www.cve.org/CVERecord?id=CVE-2026-46719

History

Mon, 18 May 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 17 May 2026 20:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Rrwo Rrwo net::statsd::tiny
Vendors & Products		Rrwo Rrwo net::statsd::tiny

Sun, 17 May 2026 18:15:00 +0000

Type	Values Removed	Values Added
Description		Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
Title		Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections
Weaknesses		CWE-93
References		https://github.com/robrwo/Net-Statsd-Tiny/commit/06f814f52fbcc0b2afddf7a2d6f8137fd3cede13.patch https://metacpan.org/release/RRWO/Net-Statsd-Tiny-v0.3.8/changes https://www.cve.org/CVERecord?id=CVE-2026-46719

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2026-05-17T17:51:41.133Z

Updated: 2026-05-26T22:47:36.662Z

Reserved: 2026-05-16T00:56:00.338Z

Link: CVE-2026-46720

Vulnrichment

Updated: 2026-05-18T12:54:18.578Z

NVD

Status : Deferred

Published: 2026-05-17T18:16:27.397

Modified: 2026-05-18T17:40:45.343

Link: CVE-2026-46720

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46720", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-05-16T00:56:00.338Z", "datePublished": "2026-05-17T17:51:41.133Z", "dateUpdated": "2026-05-26T22:47:36.662Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-Statsd-Tiny", "product": "Net::Statsd::Tiny", "programRoutines": [{"name": "Net::Statsd::Tiny::_record"}], "repo": "https://github.com/robrwo/Net-Statsd-Tiny", "vendor": "RRWO", "versions": [{"lessThan": "0.3.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.\n\nThe metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-26T22:47:36.662Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/RRWO/Net-Statsd-Tiny-v0.3.8/changes"}, {"tags": ["patch"], "url": "https://github.com/robrwo/Net-Statsd-Tiny/commit/06f814f52fbcc0b2afddf7a2d6f8137fd3cede13.patch"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-46719"}], "solutions": [{"lang": "en", "value": "Upgrade to Net::Statsd::Tiny version 0.3.8 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "Issue reported to CPANSec"}, {"lang": "en", "time": "2026-05-15T00:00:00.000Z", "value": "Author notified"}, {"lang": "en", "time": "2026-05-17T00:00:00.000Z", "value": "Fix released"}], "title": "Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections", "workarounds": [{"lang": "en", "value": "Apply the patch.\n\nAlternatively, validate that all metrics and setr values sent to the client based on untrusted data do not contain metric injections\n\nThis is the same issue CVE-2026-46719 that affected Net::Statsd::Lite."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-18T12:54:22.223047Z", "id": "CVE-2026-46720", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-18T12:54:25.742Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-46720", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-18T12:54:22.223047Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-18T12:54:18.578Z"}}], "cna": {"title": "Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/robrwo/Net-Statsd-Tiny", "vendor": "RRWO", "product": "Net::Statsd::Tiny", "versions": [{"status": "affected", "version": "0", "lessThan": "0.3.8", "versionType": "custom"}], "packageName": "Net-Statsd-Tiny", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::Statsd::Tiny::_record"}]}], "timeline": [{"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "Issue reported to CPANSec"}, {"lang": "en", "time": "2026-05-15T00:00:00.000Z", "value": "Author notified"}, {"lang": "en", "time": "2026-05-17T00:00:00.000Z", "value": "Fix released"}], "solutions": [{"lang": "en", "value": "Upgrade to Net::Statsd::Tiny version 0.3.8 or later."}], "references": [{"url": "https://metacpan.org/release/RRWO/Net-Statsd-Tiny-v0.3.8/changes", "tags": ["release-notes"]}, {"url": "https://github.com/robrwo/Net-Statsd-Tiny/commit/06f814f52fbcc0b2afddf7a2d6f8137fd3cede13.patch", "tags": ["patch"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719", "tags": ["related"]}], "workarounds": [{"lang": "en", "value": "Apply the patch.\n\nAlternatively, validate that all metrics and setr values sent to the client based on untrusted data do not contain metric injections\n\nThis is the same issue CVE-2026-46719 that affected Net::Statsd::Lite."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.\n\nThe metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-26T22:47:36.662Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46720", "state": "PUBLISHED", "dateUpdated": "2026-05-26T22:47:36.662Z", "dateReserved": "2026-05-16T00:56:00.338Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-05-17T17:51:41.133Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}