CVE-2026-50637

Katalog CVE

CVSS 8.2 · High EPSS 0,50%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada pevans metrics. Skor CVSS 3.1 8.2 (High) menurut CISA ADP.

Deskripsi (NVD)

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet. The send method does not validate the contents of the metric names or values. If the names have newlines and statsd control characters (colon, pipe) then metric injections are possible. Version 0.04 fixed this by modifying the _make method to block metric names with characters below ASCII 32 (which includes the newline), or colons or pipes.

Rincian

Terbit di NVD

10 Juni 2026

Terakhir diubah

24 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cve.org/CVERecord?id=CVE-2026-46719 advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2026-46720 advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2026-46739 advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2026-50638 advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2026-50639 advisory pihak ketiga
• https://metacpan.org/release/PEVANS/Metrics-Any-Adapter-Statsd-0.04/changes release notes