CVE-2026-46720: Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections

[Robert Rothenberg <rrwo () cpansec org>]

========================================================================
CVE-2026-46720                                       CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-46720
  Distribution:  Net-Statsd-Tiny
      Versions:  before 0.3.8

      MetaCPAN:  https://metacpan.org/dist/Net-Statsd-Tiny
      VCS Repo:  https://github.com/robrwo/Net-Statsd-Tiny


Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric
injections

Description
-----------
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric
injections.

The metric names and set values were not checked for newlines, colons
or pipes. Metrics generated from untrusted sources could inject
additional statsd metrics.

Problem types
-------------
- CWE-93 Improper Neutralization of CRLF Sequences

Workarounds
-----------
Apply the patch.

Alternatively, validate that all metrics and setr values sent to the
client based on untrusted data do not contain metric injections

This is the same issue CVE-2026-46719 that affected Net::Statsd::Lite.


Solutions
---------
Upgrade to Net::Statsd::Time version 0.3.8 or later.


References
----------
https://metacpan.org/release/RRWO/Net-Statsd-Tiny-v0.3.8/changes
https://github.com/robrwo/Net-Statsd-Tiny/commit/06f814f52fbcc0b2afddf7a2d6f8137fd3cede13.patch
https://www.cve.org/CVERecord?id=CVE-2026-46719

Timeline
--------
- 2026-05-14: Issue reported to CPANSec
- 2026-05-15: Author notified
- 2026-05-17: Fix released