CVE-2026-46720
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections
In short
Net::Statsd::Tiny for Perl allowed attackers to inject malicious metrics into monitoring data by exploiting missing validation of special characters. This could corrupt monitoring data and cause false alerts or data manipulation.
Technical detail
CWE-150 and CWE-93 vulnerability where metric names and values lack input validation for newline, colon, and pipe characters. Untrusted metric sources can inject additional statsd protocol commands, allowing protocol injection attacks that compromise monitoring integrity without authentication requirements.
Summary generated and translated by AI from the official description.
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.
The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Affected products
RRWO · Net::Statsd::TinyWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →