CVEvulnerability

CVE-2026-46741

7.5 HIGH Published 2026-06-04 Modified 2026-07-22 Official page ↗
Status
Modified
Published
2026-06-04
Last modified
2026-07-22
Assigner
9b29abf9-4ab0-4765-b253-1875cd9b441e
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-150, CWE-93

Description

Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that the git repository contains an unreleased version with the gauge and set methods that also do not check for potential metric injections.

Affected configurations

• sanbeg etsy\ \ (<= 1.002002)

Related

Weakness · CWE (2)

  • CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences weakness
  • CWE-93 Improper Neutralization of CRLF Sequences weakness

References