CVE-2026-46720
Severity CVSS v4.0:
Pending analysis
Type:
CWE-93
Improper Neutralization of CRLF Sequences ('CRLF Injection')
Publication date:
17/05/2026
Last modified:
17/05/2026
Description
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.<br />
<br />
The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.