Net::Statsite::Client CVE-2026-11373

Exploitation requires a Perl application that uses Net::Statsite::Client and passes attacker-influenced string data directly into a metric name or metric value argument without prior sanitization; the attacker also needs a statsite (or compatible statsd) collector downstream that will parse the resulting line-delimited stream. Limiting factors: the library itself is never network-exposed - reachability depends entirely on whether the host application accepts untrusted input on that code path, so deployments that emit only static or operator-defined metric labels are not exploitable. There is no authentication or user-interaction requirement at the protocol layer because statsite traffic is typically unauthenticated UDP/TCP on a trusted segment, but realistic impact is bounded to the monitoring system rather than the application host.

The NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1) appears inflated for the actual flaw: metric injection has clear integrity impact on monitoring data but no obvious confidentiality impact, so C:H is hard to justify from the description alone. The realistic risk is downstream - polluted dashboards, suppressed or fabricated alerts, and tainted capacity-planning data - rather than direct compromise of the host running the client. Exploitability is fully gated by the calling application: an attacker must reach a code path that passes attacker-controlled strings into a metric name or value, which is not a property of the library itself. No KEV listing, no published POC, and no EPSS data were supplied; the SSVC technical impact is best characterized as partial integrity (monitoring tier), not 'total'. Treat as a supply-chain hygiene fix for any Perl service that emits user-derived metrics, not a drop-everything incident.

An attacker submits a username, log message, or HTTP header value containing an embedded newline followed by a forged metric line - for example 'alice\nrevenue.usd:1000000|c' - to a Perl web service that increments a per-user counter via Net::Statsite::Client. The library transmits the raw string to the statsite collector, which parses it as two metrics and records the bogus revenue datapoint, corrupting dashboards and potentially silencing real alerts. No POC has been published, but the technique is mechanical and identical to classical CRLF-injection patterns documented for statsd clients in other languages.