CVE-2026-46739

Katalog CVE

CVSS 5.3 · Medium EPSS 0,40%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada cosimo net. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Net::Statsd versions before 0.13 for Perl allow metric injections. The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

Rincian

Terbit di NVD

4 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cosimo/perl5-net-statsd/pull/10 issue tracking · patch
• https://www.cve.org/CVERecord?id=CVE-2026-46719 advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2026-46720 advisory pihak ketiga