CVE-2026-46740Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Version 0.06 changes the module from being a statsd client to using a separate statsd client. It defaults to using a version of Net::Statsd::Tiny that fixes a similar issue (CVE-2026-46720).

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-93CWE-150

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets2 URLs

By indicator

Full discourse1 post

Open Source Security mailing list@oss_security137d
Disclosure
Perl CPAN CVE-2026-46740: Mojolicious::Plugin::Statsd through 0.04 allowed metric injections https://www.openwall.com/lists/oss-security/2026/05/26/7 CVE-2026-8647: Crypt::ScryptKDF through 0.010 uses insecure random number source when no CSPRNG module is available https://www.openwall.com/lists/oss-security/2026/05/26/8
Post summary
The text announces two newly identified CVEs affecting Perl modules, detailing the weaknesses but offering no PoC, exploit code, remediation steps, or evidence of active exploitation.
10041844
4.7K followersView on X

Explore more

Back to dashboard