VulnerabilityModified

CVE-2026-8722

Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections.

MEDIUM 6.5EPSS 0.20%

Does this matter?

Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.

Description

Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections. The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.20% probability · 10th percentile
CISA KEV: Not listed
Weakness: CWE-93, CWE-150
Affected: team/net\
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

References

https://www.cve.org/CVERecord?id=CVE-2026-46719Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-46720Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.