CVE-2026-46739

Net::Statsd versions before 0.13 for Perl allow metric injections

5.3 MediumFix available

Net::Statsd versions before 0.13 for Perl allow metric injections.

The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.26%Up 0.2 points since Jun 5, 2026

What each source reports

CVE List Score used 5.3

Net::Statsd versions before 0.13 for Perl allow metric injections

Net::Statsd versions before 0.13 for Perl allow metric injections.

The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

Record: CVE-2026-46739
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-93, CWE-150
Updated: 2026-11-02

EUVDEUVD-2026-34295 5.3

Net::Statsd versions before 0.13 for Perl allow metric injections.

The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

Record: EUVD-2026-34295
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wjp4-mf92-6wh6 5.3

Net::Statsd versions before 0.13 for Perl allow metric injections. The metric names are not...

Net::Statsd versions before 0.13 for Perl allow metric injections.

The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

Record: GHSA-wjp4-mf92-6wh6
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-93
Updated: 2026-11-02

NVD 5.3

Net::Statsd versions before 0.13 for Perl allow metric injections.

The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

Record: CVE-2026-46739
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-93, CWE-150
Updated: 2026-11-02

OSV 5.3

Net::Statsd versions before 0.13 for Perl allow metric injections

Net::Statsd versions before 0.13 for Perl allow metric injections.

The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

Record: CVE-2026-46739
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-150, CWE-93
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-46739 5.3

Net::Statsd versions before 0.13 for Perl allow metric injections. The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

Record: DEBIAN-CVE-2026-46739
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-46739 5.3

Record: UBUNTU-CVE-2026-46739
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libnet-statsd-perl` Debian:12	All versions, plus listed versions 0.12-30.12-40.12-50.13-1	None known
`libnet-statsd-perl` Debian:13	All versions, plus listed versions 0.12-40.12-50.13-1	None known
`libnet-statsd-perl` Debian:14	before 0.13-1, plus listed versions 0.12-40.12-5	0.13-1
`libnet-statsd-perl` Ubuntu:16.04:LTS	All versions, plus listed versions 0.11-10.12-1	None known
`libnet-statsd-perl` Ubuntu:18.04:LTS	All versions, plus listed versions 0.12-1	None known
`libnet-statsd-perl` Ubuntu:20.04:LTS	All versions, plus listed versions 0.12-1	None known
`libnet-statsd-perl` Ubuntu:22.04:LTS	All versions, plus listed versions 0.12-1.1	None known
`libnet-statsd-perl` Ubuntu:24.04:LTS	All versions, plus listed versions 0.12-3	None known
`libnet-statsd-perl` Ubuntu:25.10	All versions, plus listed versions 0.12-40.12-5	None known
`libnet-statsd-perl` Ubuntu:26.10	All versions, plus listed versions 0.12-50.13-1	None known
`libnet-statsd-perl` Ubuntu:26.04:LTS	All versions, plus listed versions 0.12-5	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-46739 is a medium vulnerability (CVSS 5.3) in Cosimo Net::statsd, published June 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in libnet-statsd-perl 0.13-1.

References

Show 6 moreShow less