Net::Statsd::Lite EUVD-2026-30672

Exploitation requires that the target application passes attacker-controlled input - such as user-supplied identifiers, HTTP request parameters, hostnames, or other external data - directly as metric names to Net::Statsd::Lite without prior sanitization. This is the sole enabling condition; no special server configuration, non-default feature flag, or privileged deployment mode is required. CVSS PR:N confirms no authentication is needed from the perspective of the attacker interacting with the upstream application. Exploitation is limited by the indirect attack path: the attacker cannot reach Net::Statsd::Lite directly over the network and must first identify an application that (a) runs Net::Statsd::Lite < 0.9.0 and (b) incorporates untrusted external data into metric names without validation. Impact is further bounded by Scope:Unchanged - injected metrics affect only the statsd telemetry pipeline, with no direct code execution, filesystem access, or exfiltration of application data.

The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects a network-reachable, zero-complexity, unauthenticated injection with constrained impact - both confidentiality and integrity are rated Low, availability is unaffected, and scope is unchanged. These ratings are internally consistent: the vulnerability corrupts the statsd metrics pipeline rather than granting host-level access. The EPSS score of 0.01% (1st percentile) aligns with the absence of a CISA KEV entry and the absence of any known public exploit code, placing this firmly in the theoretical-risk category at present. Real-world exploitability is indirect: an attacker cannot target Net::Statsd::Lite over the network directly; they must first identify an application that both uses the vulnerable library version and propagates attacker-controlled strings as metric names without prior sanitization. That indirect dependency materially reduces the effective attack surface. Overall, this is a genuine defect warranting a routine patch cycle but is not a critical-priority emergency absent evidence of active targeting.

An attacker who controls a value used as a statsd metric name in an application - such as a username, URL path component, or external tag - submits a payload such as legit_metric:0|c\nmalicious_metric:99999|c. The vulnerable application passes this string unmodified to Net::Statsd::Lite, which constructs and transmits a UDP datagram to the statsd daemon containing two distinct metric records; the daemon processes both, silently injecting the forged counter into monitoring dashboards and alerting pipelines. No public exploit code has been identified at time of analysis, but the attack is trivially constructible by inspection of the public patch diff alone.