CVE catalog

CVE-2026-46739

Net::Statsd versions before 0.13 for Perl allow metric injections. The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional sta

[CVE catalog]

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: Jun 4, 2026, 3:45:23 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.26% · Oct 25, 2026

Net::Statsd versions before 0.13 for Perl allow metric injections. The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libnet-statsd-perl	sid	`0.13-1`	fixed
Debian	libnet-statsd-perl	forky	`0.13-1`	fixed
Debian	libnet-statsd-perl	trixie	`0.12-4`	vulnerable
Debian	libnet-statsd-perl	bookworm	`0.12-3`	vulnerable
Cpe	libnet-statsd-perl	Not reported	Not reported	vulnerable
Cpe	net\	Not reported	`0.13`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libnet-statsd-perl	source	sid	`0.13-1`	not yet assigned	Not reported	[1139163]
Debian	libnet-statsd-perl	source	forky	`0.13-1`	not yet assigned	Not reported	[1139163]
Debian	libnet-statsd-perl	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1139163]
Debian	libnet-statsd-perl	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1139163]
Cpe	net\	cpe	Not reported	`0.13`	Not reported	Not reported	Not reported

[Debian bug #1139163]

Notes

[trixie] libnet-statsd-perl: Minor issue [bookworm] libnet-statsd-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libnet-statsd-perl]Affected
Details (2)
- 0.12-3 · all · bookworm
  Affected
  nvd · libnet-statsd-perl · debian · bookworm; nvd · libnet-statsd-perl · debian · 12
- 0.12-3 · all · bookworm
  Affected
  nvd · libnet-statsd-perl · debian · bookworm; nvd · libnet-statsd-perl · debian · 12

[Debian 13 (Trixie)]

[libnet-statsd-perl]Affected
Details (2)
- 0.12-4 · all · trixie
  Affected
  nvd · libnet-statsd-perl · debian · 13
- 0.12-4 · all · trixie
  Affected
  nvd · libnet-statsd-perl · debian · 13

Observed: Oct 23, 2026, 9:47:51 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]