Executive brief
Net::Statsite::Client is a Perl library used to send performance metrics to monitoring servers. A vulnerability in this library allows attackers to inject malicious data into the metrics stream because the software fails to properly clean up special characters like newlines. This could lead to the corruption of monitoring data or the creation of unauthorized alerts, potentially misleading operators about the health of their systems.
Technical details
Net::Statsite::Client through version 1.1.0 is vulnerable to metric injection (CRLF injection). The library fails to sanitize newlines and other protocol control characters (such as colons or pipes) from metric names and values before sending them via the statsite protocol. An attacker who can influence the input strings passed to methods like timing(), update(), unique(), or gauge() can inject additional protocol commands. This is caused by improper neutralization of CRLF sequences (CWE-93) and control sequences (CWE-150). A patch is available via the MetaCPAN security repository.
Affected products
- JASEI Net::Statsite::Client through 1.1.0
Timeline
- 2026-06-22: advisory: NVD publication date
- 2026-06-22: disclosed
References
- https://cpan.org/modules
- http://armon.github.io/statsite
- https://metacpan.org/release/JASEI/Net-Statsite-Client-1.1.0/view/lib/Net/Statsite/Client.pm
- https://security.metacpan.org/patches/N/Net-Statsite-Client/1.1.0/CVE-2026-11373-r1.patch
- https://www.cve.org/CVERecord?id=CVE-2026-46719
- https://www.cve.org/CVERecord?id=CVE-2026-46720
- https://www.cve.org/CVERecord?id=CVE-2026-46739