CVE-2026-50638

Katalog CVE

CVSS 9.1 · Critical EPSS 0,55%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada pevans metrics. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapter::DogStatsd which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability. In addition, the _tags function does not check tags for newlines or statsd control characters. The tags can be used for metric injections.

Rincian

Terbit di NVD

10 Juni 2026

Terakhir diubah

24 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cve.org/CVERecord?id=CVE-2026-50637 advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2026-50639 advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2026-9270 advisory pihak ketiga
• https://metacpan.org/release/PEVANS/Metrics-Any-Adapter-Statsd-0.04/changes release notes