EUVD-2026-30706
GHSA-vqfg-jwcg-58ww
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Lifecycle Timeline
5DescriptionNVD
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.
The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
AnalysisAI
Metric injection in the Perl module Net::Statsd::Tiny before version 0.3.8 allows remote attackers to inject arbitrary statsd metrics by smuggling newline, colon, or pipe characters through untrusted metric names or set values. The CVSS 8.2 score reflects high integrity impact from forged telemetry, and while a vendor patch is available, no public exploit has been identified at time of analysis.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all systems and applications using Net::Statsd::Tiny and prioritize by criticality. Within 7 days: Deploy Net::Statsd::Tiny version 0.3.8 or later to non-production environments and complete testing. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today