[<prev] [next>] [day] [month] [year] [list]
Message-ID: <e9a35c0c-a780-40a2-95de-5162caa1af9a@cpansec.org>
Date: Thu, 4 Jun 2026 16:55:13 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-46741: Etsy::StatsD versions through 1.002002 for Perl allow
metric injections
========================================================================
CVE-2026-46741 CPAN Security Group
========================================================================
CVE ID: CVE-2026-46741
Distribution: Etsy-StatsD
Versions: through 1.002002
MetaCPAN: https://metacpan.org/dist/Etsy-StatsD
VCS Repo: https://github.com/sanbeg/Etsy-Statsd
Etsy::StatsD versions through 1.002002 for Perl allow metric injections
Description
-----------
Etsy::StatsD versions through 1.002002 for Perl allow metric
injections.
The metric names and values are not checked for newlines, colons or
pipes. Metrics generated from untrusted sources could inject additional
statsd metrics.
Note that the git repository contains an unreleased version with the
gauge and set methods that also do not check for potential metric
injections.
Problem types
-------------
- CWE-93 Improper Neutralization of CRLF Sequences
Workarounds
-----------
Ensure only trusted data is submitted to metrics.
References
----------
https://www.cve.org/CVERecord?id=CVE-2026-46719
https://www.cve.org/CVERecord?id=CVE-2026-46720
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
