CVE-2026-46740 Details
Description
Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Version 0.06 changes the module from being a statsd client to using a separate statsd client. It defaults to using a version of Net::Statsd::Tiny that fixes a similar issue (CVE-2026-46720).
A vulnerability in Mojolicious::Plugin::Statsd, affecting versions through 0.04, allowed for metric injections. The plugin did not properly validate metric names and values, leaving room for the introduction of additional StatsD metrics from untrusted sources. This issue was addressed in version 0.06, which transitioned the plugin to use a separate StatsD client, Net::Statsd::Tiny, that mitigates similar injection risks. However, users must manually specify this client if they are using version 0.06 or later.
Users can upgrade to Mojolicious::Plugin::Statsd version 0.06 or later, which includes the necessary fix. Instructions for downloading this version are available on MetaCPAN.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 26, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/robrwo/perl-Mojolicious-Plugin-Statsd/commit/f049156982a2c0b8050f173e24a04a29ddd64853.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/RRWO/Mojolicious-Plugin-Statsd-0.06/changes | CPANSec | Release NotesVendor |
| https://www.cve.org/CVERecord?id=CVE-2026-46720 | CPANSec | Not Applicable |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | CPANSec |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Mojolicious::Plugin::Statsd | <= 0.04 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 19, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | CPANSec |