CVE-2026-46720: Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.
The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net::Statsd::Tinyto a version that resolves this vulnerability.Fixed in 0.3.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46720?
CVE-2026-46720 is considered a medium-severity vulnerability due to the potential for metric injections.
How do I fix CVE-2026-46720?
To fix CVE-2026-46720, upgrade to version 0.3.8 of Net::Statsd::Tiny for Perl or later.
What types of software are affected by CVE-2026-46720?
CVE-2026-46720 affects all versions of Net::Statsd::Tiny for Perl prior to 0.3.8.
What are metric injections in the context of CVE-2026-46720?
Metric injections refer to the unauthorized modification of metric names and values due to insufficient validation.
Can CVE-2026-46720 be exploited remotely?
Yes, CVE-2026-46720 can be exploited remotely if untrusted sources are used to generate metrics.