PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46740 RRWO CVE debrief

Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injection via unvalidated metric names and set values. The plugin failed to sanitize newlines, colons, and pipes—characters with special meaning in the StatsD protocol. Untrusted input used to construct metrics could inject additional StatsD commands, leading to metric manipulation or denial-of-service against downstream monitoring infrastructure. Version 0.06 addresses this by refactoring the module to delegate to a separate StatsD client, defaulting to Net::Statsd::Tiny (which fixes a similar issue tracked as CVE-2026-46720). The fix was published on 2026-05-26.

Vendor
RRWO
Product
Mojolicious::Plugin::Statsd
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-26
Advisory published
2026-05-26
Advisory updated
2026-05-26

Who should care

Organizations running Perl-based web applications using Mojolicious::Plugin::Statsd versions 0.04 or earlier for application metrics; DevOps/SRE teams managing StatsD/Graphite monitoring infrastructure; security teams reviewing supply chain dependencies for injection vulnerabilities.

Technical summary

The Mojolicious::Plugin::Statsd Perl module (versions ≤0.04) failed to validate metric names and values before transmission to a StatsD server. The StatsD protocol uses newlines to delimit commands, colons to separate metric names from values, and pipes to specify metric types. An attacker able to influence metric construction could inject arbitrary StatsD commands, causing metric corruption, false alerts, or resource exhaustion in monitoring pipelines. Version 0.06 mitigates this by removing direct StatsD client functionality and instead depending on Net::Statsd::Tiny, which properly escapes protocol metacharacters.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Mojolicious::Plugin::Statsd to version 0.06 or later, which delegates to a separate StatsD client with input validation
  • If immediate upgrade is not possible, validate and sanitize all untrusted input used to construct metric names and values, rejecting or escaping newlines (0x0a), colons (0x3a), and pipes (0x7c)
  • Review application logs and monitoring infrastructure for anomalous metric patterns that may indicate prior injection attempts
  • Coordinate with downstream StatsD/Graphite administrators to identify and purge any injected metrics from historical data
  • Assess whether CVE-2026-46720 affects any other StatsD client libraries in use and apply corresponding patches

Evidence notes

The CVE description and NVD source confirm the injection vector and affected versions. The patch commit (ref-4) and version 0.06 changes file (ref-5) document the remediation approach. CWE-93 (Improper Neutralization of Special Elements) is cited as the weakness type.

Official resources

2026-05-26