CVE-2026-46740: CWE-93 Improper Neutralization of CRLF Sequences in RRWO Mojolicious::Plugin::Statsd
Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Version 0.06 changes the module from being a statsd client to using a separate statsd client. It defaults to using a version of Net::Statsd::Tiny that fixes a similar issue (CVE-2026-46720).
AI Analysis
Technical Summary
CVE-2026-46740 identifies a vulnerability in Mojolicious::Plugin::Statsd versions up to 0.04 where metric names and values are not sanitized for CRLF sequences or delimiter characters such as colons and pipes. This improper neutralization (CWE-93) allows attackers to inject additional statsd metrics, potentially manipulating monitoring data. The module's update in version 0.06 replaces the internal statsd client with an external one (Net::Statsd::Tiny) that mitigates this and related vulnerabilities (e.g., CVE-2026-46720).
Potential Impact
The vulnerability allows injection of additional statsd metrics by crafting metric names or values containing newline, colon, or pipe characters. This can lead to inaccurate or misleading monitoring data, impacting the integrity of metrics collected. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
Users should upgrade to Mojolicious::Plugin::Statsd version 0.06 or later, which replaces the internal statsd client with a separate client that fixes this issue. No official patch or temporary fix is documented for versions up to 0.04. Until upgrading, avoid processing untrusted input as metric names or values.
CVE-2026-46740: CWE-93 Improper Neutralization of CRLF Sequences in RRWO Mojolicious::Plugin::Statsd
Description
Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Version 0.06 changes the module from being a statsd client to using a separate statsd client. It defaults to using a version of Net::Statsd::Tiny that fixes a similar issue (CVE-2026-46720).
CVSS v3.1
Score 5.3medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-46740 identifies a vulnerability in Mojolicious::Plugin::Statsd versions up to 0.04 where metric names and values are not sanitized for CRLF sequences or delimiter characters such as colons and pipes. This improper neutralization (CWE-93) allows attackers to inject additional statsd metrics, potentially manipulating monitoring data. The module's update in version 0.06 replaces the internal statsd client with an external one (Net::Statsd::Tiny) that mitigates this and related vulnerabilities (e.g., CVE-2026-46720).
Potential Impact
The vulnerability allows injection of additional statsd metrics by crafting metric names or values containing newline, colon, or pipe characters. This can lead to inaccurate or misleading monitoring data, impacting the integrity of metrics collected. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
Users should upgrade to Mojolicious::Plugin::Statsd version 0.06 or later, which replaces the internal statsd client with a separate client that fixes this issue. No official patch or temporary fix is documented for versions up to 0.04. Until upgrading, avoid processing untrusted input as metric names or values.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-05-17T18:04:31.500Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a162a4be29bf47b50736dd9
Added to database: 05/26/2026, 23:18:35 UTC
Last enriched: 06/19/2026, 17:16:14 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.