HIGHCVE-2026-46720Published Modified CNA CPANSec
CVE-2026-46720: Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
Metrics
- CVSS v3.1
- 8.2
- Severity
- HIGH
- Fixed in
- 0.3.8
- Affected Products
- 1
Affected packages
- RRWO / Net::Statsd::Tiny< 0.3.8 (from 0)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:NReferences