CVE-2026-46720

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46720", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-05-16T00:56:00.338Z", "datePublished": "2026-05-17T17:51:41.133Z", "dateUpdated": "2026-06-19T15:29:55.058Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-Statsd-Tiny", "product": "Net::Statsd::Tiny", "programRoutines": [{"name": "Net::Statsd::Tiny::_record"}], "repo": "https://github.com/robrwo/Net-Statsd-Tiny", "vendor": "RRWO", "versions": [{"lessThan": "0.3.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.\n\nThe metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-150", "description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-19T15:29:55.058Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/RRWO/Net-Statsd-Tiny-v0.3.8/changes"}, {"tags": ["patch"], "url": "https://github.com/robrwo/Net-Statsd-Tiny/commit/06f814f52fbcc0b2afddf7a2d6f8137fd3cede13.patch"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-46719"}], "solutions": [{"lang": "en", "value": "Upgrade to Net::Statsd::Tiny version 0.3.8 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "Issue reported to CPANSec"}, {"lang": "en", "time": "2026-05-15T00:00:00.000Z", "value": "Author notified"}, {"lang": "en", "time": "2026-05-17T00:00:00.000Z", "value": "Fix released"}], "title": "Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections", "workarounds": [{"lang": "en", "value": "Apply the patch.\n\nAlternatively, validate that all metrics and setr values sent to the client based on untrusted data do not contain metric injections\n\nThis is the same issue CVE-2026-46719 that affected Net::Statsd::Lite."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-18T12:54:22.223047Z", "id": "CVE-2026-46720", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-18T12:54:25.742Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-46720", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-18T12:54:22.223047Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-18T12:54:18.578Z"}}], "cna": {"title": "Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/robrwo/Net-Statsd-Tiny", "vendor": "RRWO", "product": "Net::Statsd::Tiny", "versions": [{"status": "affected", "version": "0", "lessThan": "0.3.8", "versionType": "custom"}], "packageName": "Net-Statsd-Tiny", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::Statsd::Tiny::_record"}]}], "timeline": [{"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "Issue reported to CPANSec"}, {"lang": "en", "time": "2026-05-15T00:00:00.000Z", "value": "Author notified"}, {"lang": "en", "time": "2026-05-17T00:00:00.000Z", "value": "Fix released"}], "solutions": [{"lang": "en", "value": "Upgrade to Net::Statsd::Tiny version 0.3.8 or later."}], "references": [{"url": "https://metacpan.org/release/RRWO/Net-Statsd-Tiny-v0.3.8/changes", "tags": ["release-notes"]}, {"url": "https://github.com/robrwo/Net-Statsd-Tiny/commit/06f814f52fbcc0b2afddf7a2d6f8137fd3cede13.patch", "tags": ["patch"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719", "tags": ["related"]}], "workarounds": [{"lang": "en", "value": "Apply the patch.\n\nAlternatively, validate that all metrics and setr values sent to the client based on untrusted data do not contain metric injections\n\nThis is the same issue CVE-2026-46719 that affected Net::Statsd::Lite."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.\n\nThe metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-150", "description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-19T15:29:55.058Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46720", "state": "PUBLISHED", "dateUpdated": "2026-06-19T15:29:55.058Z", "dateReserved": "2026-05-16T00:56:00.338Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-05-17T17:51:41.133Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-Statsd-Tiny", "product": "Net::Statsd::Tiny", "programRoutines": [{"name": "Net::Statsd::Tiny::_record"}], "repo": "https://github.com/robrwo/Net-Statsd-Tiny", "vendor": "RRWO", "versions": [{"lessThan": "0.3.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.\n\nThe metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics."}, {"lang": "es", "value": "Las versiones de Net::Statsd::Tiny anteriores a la 0.3.8 para Perl permit\u00edan inyecciones de m\u00e9tricas.\n\nLos nombres de las m\u00e9tricas y los valores establecidos no se verificaban en busca de saltos de l\u00ednea, dos puntos o barras verticales. Las m\u00e9tricas generadas a partir de fuentes no confiables podr\u00edan inyectar m\u00e9tricas statsd adicionales."}], "id": "CVE-2026-46720", "lastModified": "2026-10-26T13:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46720", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-18T12:54:22.223047Z", "version": "2.0.3"}}]}, "published": "2026-05-17T18:16:27.397", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/robrwo/Net-Statsd-Tiny/commit/06f814f52fbcc0b2afddf7a2d6f8137fd3cede13.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/RRWO/Net-Statsd-Tiny-v0.3.8/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46719"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-150"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.3.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Net::Statsd::Tiny", "source": "cna", "vendor": "RRWO"}, "product": "net::statsd::tiny", "vendor": "rrwo"}], "created": "2026-05-17T19:41:15.269718+00:00", "updated": "2026-06-19T21:15:16.852641+00:00", "vendors": ["rrwo", "rrwo$PRODUCT$net::statsd::tiny"]}