Net::Async::Statsd::Client CVE-2026-8722

The application using Net::Async::Statsd::Client must pass attacker-controlled or externally-sourced string data directly as a metric name argument to the library without prior sanitization - this is the sole enabling condition. Exploitation is unauthenticated and requires no special configuration of the library itself (PR:N, AC:L per CVSS vector). The following factors limit real-world impact: (1) the attacker's injected content only affects the StatsD metrics backend, not the application host or its persistent data stores; (2) impact is bounded to monitoring data integrity and does not provide code execution, credential access, or lateral movement capability; (3) applications that generate metric names purely from static strings (not user input) are entirely unexploitable regardless of version.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects network-reachable, zero-prerequisite exploitation with limited confidentiality and integrity impact and no availability impact. The attack complexity is low and no privileges or user interaction are required. Contrasting signals: EPSS at 0.03% (9th percentile) and absence from CISA KEV both indicate this vulnerability is not being exploited at scale or in targeted campaigns at time of analysis. The integrity impact is bounded to data pollution of the StatsD metrics backend rather than system compromise, which contextually limits business risk to monitoring integrity, alerting reliability, and potential downstream analytics manipulation. The vulnerability is most dangerous in observability pipelines where metric names derive from user-supplied input (e.g., HTTP paths, user IDs, API parameters) and where StatsD metrics influence capacity decisions or security alerting. No conflicting signals exist in the available data, but the absence of a confirmed fixed version is a gap.

An attacker interacting with a web application that records user-supplied values (such as API endpoint names, user identifiers, or search terms) as StatsD metric names crafts a request containing a string like 'legit.metric:0|c\ninjected.metric:9999|c', which Net::Async::Statsd::Client forwards unsanitized to the StatsD daemon. The StatsD server parses this as two separate metric records, polluting monitoring dashboards, potentially triggering false capacity alerts, or skewing security anomaly detection. No public exploit code is known at time of analysis, but the attack requires no authentication and minimal technical skill.