What is the CVSS score of CVE-2026-8788?

CVE-2026-8788 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Net::Statsd::Lite are affected by CVE-2026-8788?

Net::Statsd::Lite, a metrics collection library used in Perl applications, contains a metric injection vulnerability that allows attackers to corrupt StatsD metrics through unvalidated input,…

How to fix or mitigate CVE-2026-8788?

Within 24 hours: Conduct inventory of all services using Net::Statsd::Lite (search package managers and dependency manifests) and assess whether the library processes metrics from external or untrusted sources. Within 7 days: Implement input validation to reject metric names and values containing control characters (CR/LF, null bytes); restrict network access to the library to trusted internal services only; deploy alerting for anomalous metric patterns. Within 30 days: Establish process to monitor vendor advisory for patch release; evaluate migration to alternative StatsD libraries (Net::StatsD, Data::Statsd) if no vendor patch emerges within 90 days.

Net::Statsd::Lite CVE-2026-8788

EUVD-2026-30739 HIGH

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-05-18

GHSA-57h4-p8xg-x38x

Code Injection

7.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 14:22 vuln.today

CVSS changed

May 19, 2026 - 14:22 NVD

7.3 (HIGH)

CVE Published

May 18, 2026 - 06:45 nvd

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Metric injection in the Perl module Net::Statsd::Lite through version 0.10.0 allows remote attackers to inject arbitrary StatsD metrics by smuggling control characters (CRLF) into metric names or values that the library forwards without sanitization. The flaw was disclosed on the oss-security mailing list on 2026-05-18 by maintainer Robert Rothenberg, and no public exploit identified at time of analysis; EPSS is very low (0.03%, 8th percentile), reflecting limited mass-exploitation interest in a niche telemetry library.

Technical ContextAI

Net::Statsd::Lite is a lightweight Perl client used by applications to emit StatsD-format metrics (counters, gauges, timers) over UDP/TCP to a StatsD aggregator such as Graphite, Datadog Agent, or Telegraf. The root cause class is CWE-93 (Improper Neutralization of CRLF Sequences), commonly known as CRLF/argument injection: because StatsD packets are newline-delimited line-oriented text, any unescaped newline or pipe character in a user-supplied metric name, tag, or value lets an attacker terminate the current line and append entirely new metric records. The library prior to 0.10.1 forwarded caller-supplied strings into the wire protocol without stripping or rejecting these delimiters.

RemediationAI

Upgrade Net::Statsd::Lite to the upstream fix available (release v0.10.1) by installing the new distribution from CPAN (e.g., cpanm Net::Statsd::Lite@0.10.1) as documented in the v0.10.1 changes file on MetaCPAN. If upgrade is not immediately possible, the most effective compensating control is to sanitize at the application boundary - strip or reject the bytes \r, \n, and the StatsD delimiter | from any caller-supplied metric name, tag, or value before invoking the module (trade-off: requires code change in every call site and silently drops legitimate characters that happen to collide). Additionally, restrict UDP/TCP egress so the StatsD client can only reach the intended aggregator and ensure the aggregator and any downstream alerting do not treat injected metrics as authoritative; the trade-off is operational noise if metric names suddenly change shape after sanitization.