EUVD-2026-34295
GHSA-wjp4-mf92-6wh6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (CPANSec) · only source for this CVE.
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Net::Statsd versions before 0.13 for Perl allow metric injections.
The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
The update_stats (used for updating counters) and gauge methods do not check that values are numeric (which would block metric injection).
AnalysisAI
Metric injection in Net::Statsd for Perl (all versions before 0.13) allows network-reachable, unauthenticated attackers to forge additional StatsD metric lines by embedding newlines, colons, or pipes in metric names or values passed through the library. Any application that feeds untrusted external input into Net::Statsd method calls without prior sanitization is directly exposed, because the wire format uses those characters as delimiters between metrics in a single UDP datagram. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N surface warrants prompt patching wherever user-controlled strings reach metric instrumentation calls.
Technical ContextAI
Net::Statsd (CPE: cpe:2.3:a:cosimo:net::statsd:*:*:*:*:*:*:*:*) is a Perl CPAN module for shipping application telemetry to a StatsD daemon over UDP. The StatsD wire format encodes each metric as 'name:value|type', and multiple metrics are packed into a single UDP datagram separated by newline characters. The root cause is CWE-93 (Improper Neutralization of CRLF Sequences): prior to version 0.13, the timing, update_stats, gauge, increment, decrement, and direct send methods accepted metric names and values without checking for newlines (or any control character below ASCII 32), colons, or pipes. The update_stats and gauge methods additionally did not enforce numeric-only values, allowing string payloads containing the delimiter characters. Version 0.13 introduces internal _validate_metric_name and _validate_metric_value functions that call Carp::croak on forbidden characters; name validation is centralized in send() to catch all call paths, while value validation is applied at each individual entry-point method before the |type suffix is appended.
RemediationAI
Upgrade Net::Statsd to version 0.13 or later using 'cpanm Net::Statsd' or 'cpan Net::Statsd'; version 0.13 is confirmed as the fix release in the upstream Changes file and PR at https://github.com/cosimo/perl5-net-statsd/pull/10. If an immediate upgrade cannot be performed, apply compensating controls at the application layer: explicitly validate or reject any metric name string containing newlines, colons, or pipe characters before passing it to any Net::Statsd method, and ensure values passed to update_stats and gauge are verified numeric (e.g., via Scalar::Util::looks_like_number). Note that application-layer sanitization introduces maintenance risk - it must cover every call site - and the definitive fix is upgrading to 0.13 where validation is enforced centrally within the library. Refer to https://seclists.org/oss-sec/2026/q2/811 for the full disclosure context.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today