CVE-2026-46719: Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections
Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections.
The metric names were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net::Statsd::Liteto a version that resolves this vulnerability.Fixed in 0.9.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46719?
CVE-2026-46719 is classified as a medium severity vulnerability due to the potential for metric injection attacks.
How do I fix CVE-2026-46719?
To fix CVE-2026-46719, upgrade Net::Statsd::Lite to version 0.9.0 or later.
What does CVE-2026-46719 affect?
CVE-2026-46719 affects all versions of Net::Statsd::Lite for Perl prior to 0.9.0.
What type of vulnerabilities are referenced in CVE-2026-46719?
CVE-2026-46719 describes metric injection vulnerabilities due to insufficient validation of metric names.
Can CVE-2026-46719 lead to data manipulation?
Yes, CVE-2026-46719 can allow attackers to inject and manipulate statsd metrics from untrusted sources.