CVE-2026-50639

Katalog CVE

CVSS 6.5 · Medium EPSS 0,40%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada pevans metrics. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapter::SignalFx which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability. In addition, the _labels function does not check tags labels newlines or statsd control characters. The labels can be used for metric injections.

Rincian

Terbit di NVD

10 Juni 2026

Terakhir diubah

23 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cve.org/CVERecord?id=CVE-2026-50637 advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2026-50638 advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2026-9270 advisory pihak ketiga
• https://metacpan.org/release/PEVANS/Metrics-Any-Adapter-Statsd-0.04/changes release notes