PT-2026-46264 · Cosimo · Net::Statsd

Published 2026-06-04 · Updated 2026-06-04 · CVE-2026-46739

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Net::Statsd versions before 0.13 for Perl allow metric injections.

The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

The update stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-46739

Affected Products

Net::Statsd

References · 4

• https://cve.org/CVERecord?id=CVE-2026-46719 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-46720 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-46739 · Security Note
• https://github.com/cosimo/perl5-net-statsd/pull/10 · Note