COSIMO Net::Statsd up to 0.12 on Perl crlf injection

Summaryinfo

A vulnerability described as critical has been identified in COSIMO Net::Statsd up to 0.12 on Perl. Affected by this issue is some unknown functionality. Executing a manipulation can lead to crlf injection. This vulnerability is registered as CVE-2026-46739. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in COSIMO Net::Statsd up to 0.12 on Perl. This vulnerability affects an unknown code block. The manipulation with an unknown input leads to a crlf injection vulnerability. The CWE definition for the vulnerability is CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Net::Statsd versions before 0.13 for Perl allow metric injections. The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-46739 since 05/17/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 318738 (Linux Distros Unpatched Vulnerability : CVE-2026-46739), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.13 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (318738). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• COSIMO

Name

• Net::Statsd

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion