[<prev] [next>] [day] [month] [year] [list]
Message-ID: <5836cd5d-b38f-4423-9948-044464690a84@cpansec.org>
Date: Thu, 4 Jun 2026 00:47:51 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-8722: Net::Async::Statsd::Client versions through 0.005 for
Perl allow metric injections
========================================================================
CVE-2026-8722 CPAN Security Group
========================================================================
CVE ID: CVE-2026-8722
Distribution: Net-Async-Statsd
Versions: through 0.005
MetaCPAN: https://metacpan.org/dist/Net-Async-Statsd
VCS Repo: https://github.com/team-at-cpan/Net-Async-Statsd
Net::Async::Statsd::Client versions through 0.005 for Perl allow metric
injections
Description
-----------
Net::Async::Statsd::Client versions through 0.005 for Perl allow metric
injections.
The metric names are not checked for newlines, colons or pipes. Metrics
generated from untrusted sources could inject additional statsd
metrics.
Problem types
-------------
- CWE-93 Improper Neutralization of CRLF Sequences
Workarounds
-----------
Ensure only trusted data is submitted to metrics.
References
----------
https://www.cve.org/CVERecord?id=CVE-2026-46719
https://www.cve.org/CVERecord?id=CVE-2026-46720
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
