CVE-2026-50637Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections.
Updated under an hour ago ()
Does this affect you?
It affects pevans metrics::any::adapter::statsd. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet. The send method does not validate the contents of the metric names or values. If the names have newlines and statsd control characters (colon, pipe) then metric injections are possible. Version 0.04 fixed this by modifying the _make method to block metric names with characters below ASCII 32 (which includes the newline), or colons or pipes.
- CVSS
- 8.2 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
- Weakness (CWE)
- CWE-93, CWE-150
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 24, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
pevans metrics::any::adapter::statsd pevans:metrics::any::adapter::statsd | before 0.04 | NVD |
References
- https://metacpan.org/release/PEVANS/Metrics-Any-Adapter-Statsd-0.04/changesrelease-notes
- https://www.cve.org/CVERecord?id=CVE-2026-46719third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2026-46720third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2026-46739third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2026-50638third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2026-50639third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.