Is CVE-2026-46740 actively exploited?

No active exploitation of CVE-2026-46740 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-46740 be exploited remotely?

Yes. CVE-2026-46740 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-46740?

CVE-2026-46740 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-46740

MEDIUM

CVE-2026-46740

CWE-93Published: May 26, 2026· Updated: May 28, 2026

5.3

CVSS v3.1

Official Description

Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections.

The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

Version 0.06 changes the module from being a statsd client to using a separate statsd client. It defaults to using a version of Net::Statsd::Tiny that fixes a similar issue (CVE-2026-46720).

NVD Source

Technical Analysis

CVE-2026-46740 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.