CVE-2026-46741 Details
Description
Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that the git repository contains an unreleased version with the gauge and set methods that also do not check for potential metric injections.
A vulnerability exists in Etsy::StatsD versions through 1.002002, as well as in Net::Statsd::Lite versions prior to 0.9.0 and Net::Statsd::Tiny versions prior to 0.3.8, all for Perl. These versions allow metric injections because the metric names and values are not properly validated for newlines, colons, or pipes. As a result, metrics created from untrusted sources could inject additional StatsD metrics. Notably, the Git repository for Etsy::StatsD includes an unreleased version that also lacks proper validation for metric injections.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cve.org/CVERecord?id=CVE-2026-46719 | CPANSec | Third Party Advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-46720 | CPANSec | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | CPANSec |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| sanbeg etsy::statsd | <= 1.002002 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 19, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 8, 2026 | Initial Analysis | [email protected] |
| Jun 4, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | CPANSec |