CVE-2026-46741 - Vulnerability Details - OpenCVE

Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that the git repository contains an unreleased version with the gauge and set methods that also do not check for potential metric injections.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://www.cve.org/CVERecord?id=CVE-2026-46719
https://www.cve.org/CVERecord?id=CVE-2026-46720

History

Thu, 04 Jun 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 04 Jun 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that the git repository contains an unreleased version with the gauge and set methods that also do not check for potential metric injections.
Title		Etsy::StatsD versions through 1.002002 for Perl allow metric injections
Weaknesses		CWE-93
References		https://www.cve.org/CVERecord?id=CVE-2026-46719 https://www.cve.org/CVERecord?id=CVE-2026-46720

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2026-06-04T15:54:48.934Z

Updated: 2026-06-04T17:41:32.496Z

Reserved: 2026-05-17T18:04:31.500Z

Link: CVE-2026-46741

Vulnrichment

Updated: 2026-06-04T17:39:30.765Z

NVD

Status : Undergoing Analysis

Published: 2026-06-04T17:16:32.790

Modified: 2026-06-04T19:16:29.987

Link: CVE-2026-46741

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-06-04T19:30:21Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46741", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-05-17T18:04:31.500Z", "datePublished": "2026-06-04T15:54:48.934Z", "dateUpdated": "2026-06-04T17:41:32.496Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Etsy-StatsD", "product": "Etsy::StatsD", "programRoutines": [{"name": "Etsy::StatsD::timing"}, {"name": "Etsy::StatsD::update"}, {"name": "Etsy::StatsD::send"}], "repo": "https://github.com/sanbeg/Etsy-Statsd", "vendor": "SANBEG", "versions": [{"lessThanOrEqual": "1.002002", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Etsy::StatsD versions through 1.002002 for Perl allow metric injections.\n\nThe metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that the git repository contains an unreleased version with the gauge and set methods that also do not check for potential metric injections."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-04T15:54:48.934Z"}, "references": [{"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-46719"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-46720"}], "source": {"discovery": "UNKNOWN"}, "title": "Etsy::StatsD versions through 1.002002 for Perl allow metric injections", "workarounds": [{"lang": "en", "value": "Ensure only trusted data is submitted to metrics."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T17:40:21.895127Z", "id": "CVE-2026-46741", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T17:41:32.496Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-46741", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T17:40:21.895127Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T17:39:30.765Z"}}], "cna": {"title": "Etsy::StatsD versions through 1.002002 for Perl allow metric injections", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/sanbeg/Etsy-Statsd", "vendor": "SANBEG", "product": "Etsy::StatsD", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.002002"}], "packageName": "Etsy-StatsD", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Etsy::StatsD::timing"}, {"name": "Etsy::StatsD::update"}, {"name": "Etsy::StatsD::send"}]}], "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719", "tags": ["related"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46720", "tags": ["related"]}], "workarounds": [{"lang": "en", "value": "Ensure only trusted data is submitted to metrics."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Etsy::StatsD versions through 1.002002 for Perl allow metric injections.\n\nThe metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that the git repository contains an unreleased version with the gauge and set methods that also do not check for potential metric injections."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-04T15:54:48.934Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46741", "state": "PUBLISHED", "dateUpdated": "2026-06-04T17:41:32.496Z", "dateReserved": "2026-05-17T18:04:31.500Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-06-04T15:54:48.934Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}