EUVD-2026-38224
GHSA-g5q2-6jvc-qfhh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable via the calling app, no auth or UI; impact is limited integrity of the downstream monitoring system (scope changed), with no confidentiality or availability effect - so C:N, I:L, A:N.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections.
Net::Statsite::Client is a client for the statsite protocol, which is a variant of statsd.
Newlines are not removed from metric names, allowing metric injections.
Values are not sanitised for newlines or other protocol control characters such as colons or pipes, allowing metric injections.
AnalysisAI
Metric injection in the Perl module Net::Statsite::Client through version 1.1.0 allows attackers controlling metric names or values to inject arbitrary statsite protocol commands by smuggling newlines, colons, and pipe characters that the library fails to sanitize. The flaw maps to CWE-93 (CRLF Injection) and affects any application that forwards untrusted input into metric reporting. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a Perl application that uses Net::Statsite::Client and passes attacker-influenced string data directly into a metric name or metric value argument without prior sanitization; the attacker also needs a statsite (or compatible statsd) collector downstream that will parse the resulting line-delimited stream. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1) appears inflated for the actual flaw: metric injection has clear integrity impact on monitoring data but no obvious confidentiality impact, so C:H is hard to justify from the description alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a username, log message, or HTTP header value containing an embedded newline followed by a forged metric line - for example 'alice\nrevenue.usd:1000000|c' - to a Perl web service that increments a per-user counter via Net::Statsite::Client. The library transmits the raw string to the statsite collector, which parses it as two metrics and records the bogus revenue datapoint, corrupting dashboards and potentially silencing real alerts. … |
| Remediation | Upstream fix available (patch); released patched version not independently confirmed - apply the official patch from https://security.metacpan.org/patches/N/Net-Statsite-Client/1.1.0/CVE-2026-11373-r1.patch and upgrade to the next CPAN release of Net-Statsite-Client above 1.1.0 once published by JASEI. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems and applications using Net::Statsite::Client in your infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Local file tampering via symlink/junction following in Microsoft .NET runtimes 8.0, 9.0, and 10.0 allows a local unauthe
Weak PRNG in Net::NSCA::Client through 0.009002 for Perl. Patch available.
Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disru
Local privilege escalation in Microsoft .NET allows an authenticated low-privileged user to elevate to higher privileges
External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized att
Denial of service in the Perl module Net::CIDR::Set through version 0.20 allows remote unauthenticated attackers to trig
IPv6 address validation bypass in Net::CIDR::Lite for Perl (versions <0.23) allows remote attackers to circumvent IP acc
Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecod
Remote memory exhaustion in the Net::BitTorrent Perl module (all versions through 2.0.1) lets any unauthenticated peer i
Net::CIDR::Lite Perl module versions before 0.24 fail to properly validate IP address and CIDR mask inputs, allowing att
Metric name injection in Net::Async::Statsd::Client (Perl, versions through 0.005) allows network-reachable, unauthentic
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today