CVE-2026-46740

5.3 Moyenne

Publiée le 27/05/2026 à 01:16 · Modifiée le 24/07/2026 à 14:10 · Analyse NVD reportée · Source : 9b29abf9-4ab0-4765-b253-1875cd9b441e

Description

Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Version 0.06 changes the module from being a statsd client to using a separate statsd client. It defaults to using a version of Net::Statsd::Tiny that fixes a similar issue (CVE-2026-46720).

Traduire en français

Produits concernés

RRWO Mojolicious::Plugin::Statsd

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-93
CWE-150

Références

https://github.com/robrwo/perl-Mojolicious-Plugin-Statsd/commit/f049156982a2c0b8050f173e24a04a29ddd64853.patch
https://metacpan.org/release/RRWO/Mojolicious-Plugin-Statsd-0.06/changes
https://www.cve.org/CVERecord?id=CVE-2026-46720

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories