========================================================================
CVE-2026-46741                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-46741
   Distribution:  Etsy-StatsD
       Versions:  through 1.002002

       MetaCPAN:  https://metacpan.org/dist/Etsy-StatsD
       VCS Repo:  https://github.com/sanbeg/Etsy-Statsd

Etsy::StatsD versions through 1.002002 for Perl allow metric injections

Description
-----------
Etsy::StatsD versions through 1.002002 for Perl allow metric
injections.

The metric names and values are not checked for newlines, colons or
pipes. Metrics generated from untrusted sources could inject additional
statsd metrics.

Note that the git repository contains an unreleased version with the
gauge and set methods that also do not check for potential metric
injections.

Problem types
-------------
- CWE-93 Improper Neutralization of CRLF Sequences

Workarounds
-----------
Ensure only trusted data is submitted to metrics.

References
----------
https://www.cve.org/CVERecord?id=CVE-2026-46719
https://www.cve.org/CVERecord?id=CVE-2026-46720