Vulnerability · Published Jun 4, 2026 · Assigned by CPANSec

CVE-2026-46741Etsy::StatsD versions through 1.002002 for Perl allow metric injections

High 7.5

In plain English

A high-severity security flaw in Etsy::StatsD from SANBEG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 81.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that the git repository contains an unreleased version with the gauge and set methods that also do not check for potential metric injections.

Affected products (as reported)

Vendor	Product	Versions
SANBEG	Etsy::StatsD	0 – through 1.002002

Weakness: CWE-93, CWE-150 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://www.cve.org/CVERecord?id=CVE-2026-46719 related
https://www.cve.org/CVERecord?id=CVE-2026-46720 related