CVE-2026-50637

HighCVSS 8.2/10Last modified Jun 24, 2026

Description

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections.

The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet.

The send method does not validate the contents of the metric names or values. If the names have newlines and statsd control characters (colon, pipe) then metric injections are possible.

Version 0.04 fixed this by modifying the _make method to block metric names with characters below ASCII 32 (which includes the newline), or colons or pipes.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-93 CWE-150

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2026
Last modified: Jun 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-506389.1Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensi CVE-2026-506396.5Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensio CVE-2026-50648.5Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow fo CVE-2026-506417.1Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, us CVE-2026-506424.8diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SG CVE-2026-506435.18cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-c CVE-2026-506448.6SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL com CVE-2026-506457.5There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead CVE-2026-506467.8Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.CVE-2026-506477.5Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to de CVE-2026-506487.5Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.CVE-2026-506497.8Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.