Executive brief
Net::Statsd::Lite is a Perl library used to send performance metrics to monitoring systems. A vulnerability in versions before 0.9.0 allows attackers to inject fake or malicious data into these monitoring systems if the application uses untrusted input for metric names. This could lead to corrupted dashboards, false alerts, or the masking of actual system issues.
Technical details
Net::Statsd::Lite versions prior to 0.9.0 are vulnerable to CRLF and protocol injection (CWE-93). The library failed to sanitize metric names for newlines (\n), colons (:), or pipes (|), which are control characters in the StatsD protocol. If an application passes untrusted user input directly into metric names, an attacker can inject additional, arbitrary metrics into the data stream. This is resolved in version 0.9.0 by implementing validation checks that croak upon encountering these characters.
Affected products
- Robert Rothenberg Net::Statsd::Lite < 0.9.0
Timeline
- 2026-05-16: disclosed
- 2026-05-16: patched: Fixed in version 0.9.0
- 2026-05-16: advisory