CVE-2026-46740: Mojolicious Plugin Statsd Injection Flaw

CVE-2026-46740 Overview

CVE-2026-46740 affects Mojolicious::Plugin::Statsd versions through 0.04 for Perl. The plugin failed to sanitize metric names and set values, allowing newline, colon, and pipe characters to pass through unchecked. Applications that generate statsd metrics from untrusted input could be coerced into emitting attacker-controlled metrics to the downstream statsd server. The maintainer addressed the flaw in version 0.06 by delegating protocol handling to Net::Statsd::Tiny, which performs proper input validation. This issue is classified under [CWE-93] (Improper Neutralization of CRLF Sequences).

Critical Impact
Untrusted input passed into metric names or values can inject arbitrary statsd metrics, corrupting telemetry, triggering false alerts, or masking operational signals.

Affected Products

Mojolicious::Plugin::Statsd versions through 0.04
Perl applications using the plugin to forward metrics derived from untrusted sources
Statsd collection pipelines downstream of vulnerable Mojolicious applications

Discovery Timeline

2026-05-26 - CVE-2026-46740 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46740

Vulnerability Analysis

The statsd line protocol delimits metrics with newline characters and uses colons and pipes to separate the metric name, value, and type. Mojolicious::Plugin::Statsd accepted these characters inside metric names and set values without filtering. An attacker who controls input that feeds a metric name or value can embed delimiter characters to terminate the legitimate metric and append additional metrics in the same payload. The downstream statsd daemon parses the injected lines as if they were emitted by the application. The vulnerability falls under the metric injection variant of CRLF-style injection ([CWE-93]).

Root Cause

The plugin acted as its own statsd client and constructed the wire-format payload by interpolating caller-supplied strings directly into the line protocol. There was no rejection or escaping of newline (\n), colon (:), or pipe (|) characters. Any code path that passed user-influenced data into the metric name or set value inherited the injection flaw.

Attack Vector

An attacker submits input such as a username, search term, or HTTP header value that is later used as a statsd metric label or set member. By including a newline followed by a crafted metric line, the attacker forces the application to emit forged metrics. These can inflate counters, register fake gauges, or pollute set cardinality used for unique-user tracking, undermining monitoring and alerting systems.

text

[Security]
- Fixed metric injection CVE-2026-46740

[Enhancements]
- Use Net::Statsd::Tiny for handling the statsd protocol
- Added the client attribute for choosing any statsd client

Source: GitHub Patch for Commit f049156

The patch removes the in-tree statsd client and adds Net::Statsd::Tiny (v0.4.0) as a dependency, which itself remediated a comparable issue tracked as CVE-2026-46720.

Detection Methods for CVE-2026-46740

Indicators of Compromise

Statsd traffic containing unexpected metric names that do not match any application-defined identifier
Metric payloads containing literal newline characters originating from user-controlled fields
Sudden cardinality spikes in set-type metrics tied to a single request path
Counter or gauge values appearing for metric names not declared in application source code

Detection Strategies

Inspect the installed Mojolicious::Plugin::Statsd version with cpan -l or cpanm --info and flag any installation at or below 0.04
Enable verbose logging on the statsd daemon and diff received metric names against an allow list of application-emitted names
Audit application source for calls that pass request parameters, headers, or database fields directly into statsd metric methods

Monitoring Recommendations

Monitor outbound UDP traffic to statsd collectors for payloads exceeding expected line lengths or containing embedded \n sequences
Alert on appearance of new, previously unseen metric names in collectors such as Graphite, Datadog, or InfluxDB
Track dependency manifests (cpanfile, Makefile.PL) in CI to fail builds that pin vulnerable versions of the plugin

How to Mitigate CVE-2026-46740

Immediate Actions Required

Upgrade Mojolicious::Plugin::Statsd to version 0.06 or later, which routes metrics through Net::Statsd::Tiny v0.4.0
Audit application code paths that pass external input into increment, gauge, timing, or set calls and apply input sanitization
Ensure transitive dependency Net::Statsd::Tiny is at version v0.4.0 or later to inherit the fix for CVE-2026-46720

Patch Information

The upstream fix is committed in f049156982a2c0b8050f173e24a04a29ddd64853 and released as Mojolicious-Plugin-Statsd-0.06 on CPAN. The MetaCPAN Release Change Log documents both the security fix and the switch to Net::Statsd::Tiny. The corresponding patch is available at the GitHub Patch for Commit f049156.

Workarounds

Strip or reject \n, :, and | characters from any value before passing it to the plugin
Wrap statsd calls with an allow list of static metric names and never interpolate untrusted input into the name field
Restrict statsd collector ingress to trusted application hosts via firewall rules to limit the blast radius of injected metrics

bash

# Configuration example: pin a safe version in cpanfile
requires "Mojolicious::Plugin::Statsd" => "0.06";
requires "Net::Statsd::Tiny" => "v0.4.0";