[<prev] [next>] [day] [month] [year] [list]
Message-ID: <9fe97594-392c-49dd-83c9-2c5dfc629b5a@cpansec.org>
Date: Sun, 17 May 2026 18:55:25 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-46720: Net::Statsd::Tiny versions before 0.3.8 for Perl
allowed metric injections
========================================================================
CVE-2026-46720 CPAN Security Group
========================================================================
CVE ID: CVE-2026-46720
Distribution: Net-Statsd-Tiny
Versions: before 0.3.8
MetaCPAN: https://metacpan.org/dist/Net-Statsd-Tiny
VCS Repo: https://github.com/robrwo/Net-Statsd-Tiny
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric
injections
Description
-----------
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric
injections.
The metric names and set values were not checked for newlines, colons
or pipes. Metrics generated from untrusted sources could inject
additional statsd metrics.
Problem types
-------------
- CWE-93 Improper Neutralization of CRLF Sequences
Workarounds
-----------
Apply the patch.
Alternatively, validate that all metrics and setr values sent to the
client based on untrusted data do not contain metric injections
This is the same issue CVE-2026-46719 that affected Net::Statsd::Lite.
Solutions
---------
Upgrade to Net::Statsd::Time version 0.3.8 or later.
References
----------
https://metacpan.org/release/RRWO/Net-Statsd-Tiny-v0.3.8/changes
https://github.com/robrwo/Net-Statsd-Tiny/commit/06f814f52fbcc0b2afddf7a2d6f8137fd3cede13.patch
https://www.cve.org/CVERecord?id=CVE-2026-46719
Timeline
--------
- 2026-05-14: Issue reported to CPANSec
- 2026-05-15: Author notified
- 2026-05-17: Fix released
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
