EUVD-2026-34188
GHSA-hpgh-hpwg-532v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (CPANSec) · only source for this CVE.
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections.
The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
AnalysisAI
Metric name injection in Net::Async::Statsd::Client (Perl, versions through 0.005) allows network-reachable, unauthenticated attackers to inject arbitrary StatsD metrics by supplying untrusted input containing unfiltered newlines, colons, or pipe characters. Because the StatsD wire protocol uses these characters as structural delimiters, unsanitized metric names sourced from user-controlled data can be interpreted as additional, attacker-controlled metrics by the receiving StatsD server. No public exploit identified at time of analysis and EPSS sits at the 9th percentile (0.03%), indicating low observed exploitation pressure, but any Perl application forwarding externally-supplied values as StatsD metric names is directly in scope.
Technical ContextAI
Net::Async::Statsd::Client is an asynchronous Perl client library for the StatsD UDP protocol, which encodes metrics in a line-based text format using colons (':') to separate metric name from value, pipes ('|') to separate value from type, and newlines ('\n') to delimit individual metric records. CWE-93 (Improper Neutralization of CRLF Sequences / CRLF Injection) describes precisely this root cause: when user-supplied strings are interpolated into a structured protocol without stripping control characters, an attacker can terminate one record and begin another, effectively forging metrics. The affected CPE is cpe:2.3:a:team:net::async::statsd::client:*:*:*:*:*:*:*:* covering all releases up to and including 0.005. Related sibling issues CVE-2026-46719 and CVE-2026-46720 are referenced by the same advisories and likely address adjacent injection vectors in the same or closely related StatsD client libraries.
RemediationAI
No vendor-released patch identified at time of analysis - an exact fixed version is not confirmed in the available advisory data. Operators should monitor the CPAN distribution page for Net::Async::Statsd::Client and the oss-security thread at https://seclists.org/oss-sec/2026/q2/805 for a patched release. As an immediate compensating control, applications should sanitize all metric name strings before passing them to the library by stripping or rejecting any characters outside the safe StatsD name character set (alphanumerics, underscores, dots, and hyphens); this can be enforced at the application layer with a simple regex substitution. A second option is to avoid passing externally-controlled strings as metric names entirely - use static metric names with only the numeric value sourced from user input, which is never susceptible to this injection class. Note that if the StatsD listener is on an internal network and the application already validates user input upstream, residual risk is significantly reduced, but defense-in-depth at the library boundary remains the preferred long-term fix.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today