[<prev] [next>] [day] [month] [year] [list]
Message-ID: <3474d514-d316-49bc-adad-5d1ec4deb970@cpansec.org>
Date: Tue, 26 May 2026 23:49:45 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-46740: Mojolicious::Plugin::Statsd versions through 0.04 for
Perl allowed metric injections
========================================================================
CVE-2026-46740 CPAN Security Group
========================================================================
CVE ID: CVE-2026-46740
Distribution: Mojolicious-Plugin-Statsd
Versions: through 0.04
MetaCPAN: https://metacpan.org/dist/Mojolicious-Plugin-Statsd
VCS Repo: https://github.com/robrwo/perl-Mojolicious-Plugin-Statsd
Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed
metric injections
Description
-----------
Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed
metric injections.
The metric names and set values were not checked for newlines, colons
or pipes. Metrics generated from untrusted sources could inject
additional statsd metrics.
Version 0.06 changes the module from being a statsd client to using a
separate statsd client. It defaults to using a version of
Net::Statsd::Tiny that fixes a similar issue (CVE-2026-46720).
Problem types
-------------
- CWE-93 Improper Neutralization of CRLF Sequences
Solutions
---------
Upgrade to Mojolicious::Plugin::Statsd version 0.06 or later.
References
----------
https://metacpan.org/release/RRWO/Mojolicious-Plugin-Statsd-0.06/changes
https://github.com/robrwo/perl-Mojolicious-Plugin-Statsd/commit/f049156982a2c0b8050f173e24a04a29ddd64853.patch
https://www.cve.org/CVERecord?id=CVE-2026-46720
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
