CVE-2026-46720: high-severity vulnerability in RRWO Net::Statsd::Tiny
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Net::Statsd::Tiny for Perl allowed attackers to inject malicious metrics into monitoring data by exploiting missing validation of special characters. This could corrupt monitoring data and cause false alerts or data manipulation.
CWE-150 and CWE-93 vulnerability where metric names and values lack input validation for newline, colon, and pipe characters. Untrusted metric sources can inject additional statsd protocol commands, allowing protocol injection attacks that compromise monitoring integrity without authentication requirements.