ByteOS Network

NVD Vulnerability Details :

CVE-2026-46740

Deferred

Source-9b29abf9-4ab0-4765-b253-1875cd9b441e

Published At-26 May, 2026 | 23:16

Updated At-28 May, 2026 | 16:16

Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Version 0.06 changes the module from being a statsd client to using a separate statsd client. It defaults to using a version of Net::Statsd::Tiny that fixes a similar issue (CVE-2026-46720).

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE ID	Type	Source
CWE-93	Secondary	9b29abf9-4ab0-4765-b253-1875cd9b441e

CWE ID: CWE-93

Type: Secondary

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

References

Hyperlink	Source	Resource
https://github.com/robrwo/perl-Mojolicious-Plugin-Statsd/commit/f049156982a2c0b8050f173e24a04a29ddd64853.patch	9b29abf9-4ab0-4765-b253-1875cd9b441e	N/A
https://metacpan.org/release/RRWO/Mojolicious-Plugin-Statsd-0.06/changes	9b29abf9-4ab0-4765-b253-1875cd9b441e	N/A
https://www.cve.org/CVERecord?id=CVE-2026-46720	9b29abf9-4ab0-4765-b253-1875cd9b441e	N/A