CVE-2026-46719

MediumCVSS 6.5/10Last modified Jun 19, 2026

Description

Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections.

The metric names were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-93CWE-150

Affected software

No affected versions have been published.

Timeline

Published
May 16, 2026
Last modified
Jun 19, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-46724.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 thCVE-2026-467208.2Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. The metric names and set values were not checked for newlines, CVE-2026-467216.9The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user grouCVE-2026-467225.9The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed direCVE-2026-467235.9The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permissCVE-2026-467245.9The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index dCVE-2026-467259.2The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthentiCVE-2026-467267.5Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in ACVE-2026-467278.1An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handleCVE-2026-467288.8Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.CVE-2026-467297.5NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP ServCVE-2026-46738.8Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write
CVE-2026-46719: Medium severity, CVSS 6.5 | Vulnix