The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| RRWO | Net::Statsd::Tiny | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to Net::Statsd::Time version 0.3.8 or later.
Workaround
Apply the patch. Alternatively, validate that all metrics and setr values sent to the client based on untrusted data do not contain metric injections This is the same issue CVE-2026-46719 that affected Net::Statsd::Lite.
Sun, 17 May 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. | |
| Title | Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections | |
| Weaknesses | CWE-93 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-05-17T17:51:41.133Z
Reserved: 2026-05-16T00:56:00.338Z
Link: CVE-2026-46720
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-17T18:16:27.397
Modified: 2026-05-17T18:16:27.397
Link: CVE-2026-46720
Redhat
No data.
OpenCVE Enrichment
No data.