Executive brief
Etsy::StatsD is a Perl library used to send application performance data to monitoring systems. A security flaw allows attackers to inject fake or malicious data into these monitoring reports if the application uses untrusted user input to name or value its metrics. This could lead to inaccurate business dashboards, false alerts, or the corruption of monitoring data used for operational decisions.
Technical details
The Etsy::StatsD Perl library fails to validate or sanitize metric names and values for control characters such as newlines (\n), colons (:), and pipes (|). This vulnerability, classified as CWE-93 (Improper Neutralization of CRLF Sequences), allows an attacker who can influence metric data to inject additional, unauthorized StatsD protocol commands. By including a newline character in a metric name or value, an attacker can terminate the current metric and start a new one, effectively spoofing monitoring data. This issue persists in version 1.002002 and is also present in unreleased versions containing gauge and set methods.
Affected products
- Etsy StatsD through 1.002002
Timeline
- 2026-06-04: disclosed: Initial publication of CVE-2026-46741