Executive brief
Net::Statsd::Tiny is a Perl library used to send performance metrics to monitoring systems. A security flaw in versions before 0.3.8 allows attackers to inject fake or malicious data into these monitoring systems if the application uses untrusted input for metric names or values. This could lead to corrupted monitoring dashboards, false alerts, or the masking of actual system issues.
Technical details
Net::Statsd::Tiny prior to version 0.3.8 is vulnerable to metric injection (CWE-93). The library failed to validate metric names and set values for newlines, colons, or pipe characters. An attacker who can influence the input passed to metric generation functions can inject additional, arbitrary StatsD metrics into the network stream. This occurs because the library constructs the StatsD protocol string by simple concatenation without sanitizing control characters that define protocol boundaries. The issue is fixed in version 0.3.8 by implementing regex-based validation that rejects inputs containing ASCII control characters (below 32), colons, or pipes.
Affected products
- Robert Rothenberg Net::Statsd::Tiny before 0.3.8
Timeline
- 2026-05-17: disclosed
- 2026-05-17: patched: Fixed in version 0.3.8
- 2026-05-17: advisory