CVE-2026-50637

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet. The send method does not validate the contents of the metric names or values. If the names have newlines and statsd control characters (colon, pipe) then metric injections are possible. Version 0.04 fixed this by modifying the _make method to block metric names with characters below ASCII 32 (which includes the newline), or colons or pipes.

• CWE-93
• CWE-150

• https://metacpan.org/release/PEVANS/Metrics-Any-Adapter-Statsd-0.04/changesRelease Notes
• https://www.cve.org/CVERecord?id=CVE-2026-46719Third Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2026-46720Third Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2026-46739Third Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2026-50638Third Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2026-50639Third Party Advisory

Published

Jun 10, 2026

Last Modified

Jun 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50631A race condition in AbstractOAuthDataProvider allows concurr…7.4
• CVE-2026-50632A further incomplete fix for a previous advisory CVE-2026-44…8.1
• CVE-2026-50633A JNDI Injection vulnerability has been discovered in Apache…8.1
• CVE-2026-50634A vulnerability in Apache CXF's JwsJsonContainerRequestFilte…6.5
• CVE-2026-50635LimeSurvey constructs account password-reset links from the …8.8
• CVE-2026-50636The RemoteControl API methods invite_participants and remind…8.8
• CVE-2026-50638Metrics::Any::Adapter::DogStatsd versions before 0.04 for Pe…9.1
• CVE-2026-50639Metrics::Any::Adapter::SignalFx versions before 0.04 for Per…6.5
• CVE-2026-5064Potential security vulnerabilities have been identified in t…8.5
• CVE-2026-50641Streamsoft Business Intelligence (BI) stores users' password…7.1
• CVE-2026-50642diff‑so‑fancy does not properly sanitize non‑SGR terminal co…4.8
• CVE-2026-506438cc is vulnerable to an Out‑of‑Bounds Read due to improper h…5.1