PT-2026-43429 · Rrwo+1 · Mojolicious::Plugin::Statsd+1

Robert Rothenberg · Published 2026-05-26 · Updated 2026-06-19 · CVE-2026-46740

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mojolicious::Plugin::Statsd versions prior to 0.06

Description This issue allows metric injections when processing data from untrusted sources. The software fails to validate metric names and set values for the presence of newlines, colons, or pipes, which can be used to inject additional statsd metrics.

Recommendations Update Mojolicious::Plugin::Statsd to version 0.06 or later.

Exploit

Fix

Weakness Enumeration

CWE-150

CWE-93

Related Identifiers

CVE-2026-46740

Affected Products

Mojolicious::Plugin::Statsd

Perl-Mojolicious-Plugin-Statsd

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46740.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46740 · Security Note
• https://osv.dev/vulnerability/CVE-2026-46740 · Vendor Advisory
• https://github.com/robrwo/perl-Mojolicious-Plugin-Statsd/commit/f049156982a2c0b8050f173e24a04a29ddd64853.patch · Patch
• https://cve.org/CVERecord?id=CVE-2026-46720 · Security Note
• https://t.me/cveNotify/171086 · Telegram Post
• https://github.com/robrwo/perl-Mojolicious-Plugin-Statsd · Note
• https://metacpan.org/release/RRWO/Mojolicious-Plugin-Statsd-0.06/changes · Note
• https://cpan.org/modules · Note
• https://twitter.com/oss_security/status/2059926743868137840 · Twitter Post
• https://t.me/CVEtracker/55044 · Telegram Post