PUBLISHED
2026-06-22 12:16
MODIFIED
2026-06-22 12:16
EPSS (Prob. Exploit)
0.57%
Top 53.6%
> DESCRIPTION
Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections.
Net::Statsite::Client is a client for the statsite protocol, which is a variant of statsd.
Newlines are not removed from metric names, allowing metric injections.
Values are not sanitised for newlines or other protocol control characters such as colons or pipes, allowing metric injections.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-93: Improper Neutralization of CRLF Sequences - The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. | CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences - The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
> GITHUB SECURITY ADVISORY
GHSA-crwc-vw2r-qr6m
MODERATE
OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
AFFECTED PACKAGES:
MAVEN / ognl:ognl
<= 3.4.12
Fixed in: 3.4.13
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections
AFFECTED PACKAGES:
Unknown / Unknown
1 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
22/06/2026 12:16
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') - The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutr...
Nouvelle valeur:
CWE-93: Improper Neutralization of CRLF Sequences - The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectl...
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') - The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutr...
Total des modifications: 2
Dernière mise à jour: 5 days ago