EUVD-2026-30672
GHSA-2x39-j499-jv87
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (CPANSec) · only source for this CVE.
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections.
The metric names were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
AnalysisAI
Metric injection in Net::Statsd::Lite (Perl) affects all releases before v0.9.0, allowing unauthenticated remote attackers to inject arbitrary statsd metrics by embedding newline, colon, or pipe characters into metric names derived from untrusted input. Because the statsd wire protocol uses these characters as record separators and field delimiters, an unsanitized metric name can smuggle additional forged metrics into the UDP stream transmitted to a statsd daemon, corrupting monitoring and telemetry data. No public exploit code exists at time of analysis and the EPSS score of 0.01% (1st percentile) indicates negligible observed exploitation activity; however, the patch diff makes exploitation trivially constructible by any attacker who can influence metric name values in a vulnerable application.
Technical ContextAI
Net::Statsd::Lite is a lightweight Perl CPAN module (author: RRWO; CPE: cpe:2.3:a:rrwo:net::statsd::lite:*:*:*:*:*:*:*:*) that sends metrics to a statsd daemon over UDP. The statsd wire protocol encodes metrics in the format <name>:<value>|<type>, with newlines used to separate multiple metric records in a single datagram. Because colons and pipes delimit fields within a record, and newlines delimit records themselves, injecting any of these characters into a metric name allows the construction of fully-formed additional metric records. CWE-93 (Improper Neutralization of CRLF Sequences / CRLF Injection) precisely characterizes the root cause: the library accepted user-controlled metric name strings without rejecting or stripping protocol-significant characters. The v0.9.0 fix, visible in the public commit diff, adds two croak guards in lib/Net/Statsd/Lite.pm: one rejecting metric names matching /[\n:|]/ and one rejecting suffixes matching /[\n]/, refusing malformed input at the library boundary rather than silently passing it through.
RemediationAI
Upgrade Net::Statsd::Lite to version 0.9.0 or later - this is the vendor-released patch confirmed by both the CPAN changelog (https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.9.0/changes) and the public commit (https://github.com/robrwo/Net-Statsd-Lite/commit/e1a8ab866d75c2827982134e9cf7e51a7f771153.patch). Install via cpanm Net::Statsd::Lite or your organization's preferred CPAN mirror. If an immediate upgrade is blocked (e.g., by frozen dependency trees), a compensating control is to sanitize or reject any user-controlled string at the application layer before passing it as a metric name - specifically, strip or refuse strings matching /[\n:|]/. This workaround must be applied consistently at every call site that feeds external data into Net::Statsd::Lite, introducing maintenance complexity; upgrading to v0.9.0 is the definitive and recommended resolution with no known functional regressions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today