CVE-2026-8722

Published: Jun 4, 2026Modified: Jul 22, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections. The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

Affected (1)

Products: Team: Net\

Team

1 product

Net\

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Team Net\	Up to 0.005

Related CWEs

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

References (2)

https://www.cve.org/CVERecord?id=CVE-2026-46719

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Third Party Advisory

https://www.cve.org/CVERecord?id=CVE-2026-46720

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Third Party Advisory

Timeline

No history available yet.