EUVD-2026-30739
GHSA-57h4-p8xg-x38x
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Metric injection in the Perl module Net::Statsd::Lite through version 0.10.0 allows remote attackers to inject arbitrary StatsD metrics by smuggling control characters (CRLF) into metric names or values that the library forwards without sanitization. The flaw was disclosed on the oss-security mailing list on 2026-05-18 by maintainer Robert Rothenberg, and no public exploit identified at time of analysis; EPSS is very low (0.03%, 8th percentile), reflecting limited mass-exploitation interest in a niche telemetry library.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Conduct inventory of all services using Net::Statsd::Lite (search package managers and dependency manifests) and assess whether the library processes metrics from external or untrusted sources. Within 7 days: Implement input validation to reject metric names and values containing control characters (CR/LF, null bytes); restrict network access to the library to trusted internal services only; deploy alerting for anomalous metric patterns. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today