Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for the statsite protocol, which is a variant of statsd. Newlines are not removed from metric names, allowing metric injections. Values are not sanitised for newlines or other protocol control characters such as colons or pipes, allowing metric injections.
Net::Statsite::Client is a client for the statsite protocol (a variant of statsd). The library does not sanitize newline characters in metric names, allowing injection of additional lines into the protocol stream. Additionally, metric values are not sanitized for newline characters or other protocol control characters such as colon (:) or pipe (|). Lack of input validation enables an attacker who controls metric names or values to manipulate messages parsed on the server side.
An attacker can inject false metrics into the monitoring system, manipulate statistical data, or overwrite existing metric values, which may lead to violation of integrity and confidentiality of collected data.
A patch should be applied at the address indicated in the vendor references: https://security.metacpan.org/patches/N/Net-Statsite-Client/1.1.0/CVE-2026-11373-r1.patch. It is recommended to update the library to a version containing the fix according to information available in the CPAN repository.
Net::Statsite::Client for Perl in versions up to and including 1.1.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N