EUVD-2026-38224
GHSA-g5q2-6jvc-qfhh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable via the calling app, no auth or UI; impact is limited integrity of the downstream monitoring system (scope changed), with no confidentiality or availability effect - so C:N, I:L, A:N.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections.
Net::Statsite::Client is a client for the statsite protocol, which is a variant of statsd.
Newlines are not removed from metric names, allowing metric injections.
Values are not sanitised for newlines or other protocol control characters such as colons or pipes, allowing metric injections.
AnalysisAI
Metric injection in the Perl module Net::Statsite::Client through version 1.1.0 allows attackers controlling metric names or values to inject arbitrary statsite protocol commands by smuggling newlines, colons, and pipe characters that the library fails to sanitize. The flaw maps to CWE-93 (CRLF Injection) and affects any application that forwards untrusted input into metric reporting. No public exploit identified at time of analysis, and the issue is not on CISA KEV.
Technical ContextAI
Net::Statsite::Client (CPAN distribution by JASEI, CPE cpe:2.3:a:jasei:net::statsite::client) is a Perl client for the statsite protocol - a high-performance C variant of Etsy's statsd. The wire protocol is plaintext, line-delimited UDP/TCP, where each metric follows the structure '<name>:<value>|<type>[|@<rate>]' and entries are separated by '\n'. CWE-93 applies here because the client builds these strings via concatenation without stripping or rejecting the delimiters '\n', ':' and '|' from caller-supplied metric names and values. An application that lets external input flow into the metric name or value (e.g., username, request path, error string) effectively lets that input forge or append additional metrics in the same packet, which the collector treats as legitimate.
RemediationAI
Upstream fix available (patch); released patched version not independently confirmed - apply the official patch from https://security.metacpan.org/patches/N/Net-Statsite-Client/1.1.0/CVE-2026-11373-r1.patch and upgrade to the next CPAN release of Net-Statsite-Client above 1.1.0 once published by JASEI. As an immediate compensating control until the patched release is pinned in your cpanfile/Carton/dist.ini, wrap all caller-supplied metric names and values in a sanitizer that rejects or strips the bytes '\n', '\r', ':' and '|' before they reach the client's emit functions; the trade-off is that legitimate metric names containing colons (e.g., namespaced keys) will be mangled, so prefer an allowlist of '[A-Za-z0-9_.-]' for names. Additionally, restrict the statsite collector's listener to loopback or an internal segment so injected packets cannot be sourced from outside the trust boundary, accepting that this does not stop in-process injection from a vulnerable caller. Cross-reference the related entries CVE-2026-46719, CVE-2026-46720, and CVE-2026-46739 listed on cve.org when auditing the dependency tree.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today