CVE-2026-46719: medium-severity vulnerability in RRWO Net::Statsd::Lite
Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A vulnerability in Net::Statsd::Lite allows attackers to inject extra metrics into monitoring systems by adding special characters to metric names. This can disrupt monitoring, hide real data, or send false metrics.
CWE-150 and CWE-93 vulnerabilities: metric names lack validation for newline, colon, and pipe characters, enabling injection of arbitrary StatsD protocol commands. Exploitation requires an attacker to control metric names passed to the library; successful injection can introduce false metrics or protocol manipulation affecting monitoring integrity.
In the same product, most dangerous first.