Executive brief
Net::Statsd is a Perl library used to send performance and monitoring data to a StatsD server. A vulnerability in versions before 0.13 allows an attacker to inject fake monitoring data by including special characters like newlines or colons in metric names or values. This could lead to inaccurate business metrics, false alerts, or the masking of actual system issues.
Technical details
Net::Statsd fails to validate metric names and values for control characters (newlines), colons, or pipes before sending them to the StatsD server. Because the StatsD wire format uses these characters as delimiters (name:value|type\n), an attacker providing untrusted input to functions like update_stats, gauge, or send can forge additional, arbitrary metric entries. The vulnerability is rooted in the lack of sanitization in the send() funnel and entry-point methods. Version 0.13 introduces _validate_metric_name() and _validate_metric_value() to enforce numeric values and strip illegal characters.
Affected products
- cosimo (Perl CPAN) Net::Statsd < 0.13
Timeline
- 2026-06-02: other: Fixes developed and tested
- 2026-06-03: patched: Merged fix and bumped version to 0.13
- 2026-06-04: disclosed: CVE published to NVD